Pricing and oracles

Collateral is valued at the lower of two moving averages, never the spot price. A native market reads only its own trades; an oracle-guided one lets one feed bend its curve within set limits.

Updated Nov 9, 2026

A native market never reads a price from outside itself; an oracle-guided market reads one configured feed and lets it bend the curve, within limits. Either way the program keeps a small set of internal observations and uses a different one for each job: the live curve to trade, smoothed prices and depth to lend, and cached references to settle.

The observations

Observation	What it is	Half-life
Spot	The curve's marginal price at the current reserves	none
Symmetric EMA	A two-way exponential moving average of the spot price	Configurable, one minute to twelve hours; one hour by default
Directional EMA	Snaps down to the spot on any fall, eases up on a rise	Configurable, one minute to twelve hours
Pessimistic price	The lower of the two averages	derived
Depth EMA	A moving average of observed curve depth	Configurable
Pessimistic depth	The lower of the observed depth and its average	derived
Centre EMA	The concentration centre the curve is built around	Configurable, typically hours
Settlement reference	A cached price the hLP vaults settle against, with a divergence guard	cached
Oracle feed	Oracle-guided markets only: one external report, authenticated on every price-sensitive instruction	Must be newer than its maximum age

Symmetric half-life60 min

Spot
Symmetric average · liquidations
Lower of the two averages · new borrows

Four sample hours of spot price.

The two averages do different jobs. The symmetric one resists manipulation: a spike must be held for a full half-life to move it even halfway, which costs the manipulator real inventory, and liquidation health uses it alone. The directional one protects lenders when they lend: it follows a real fall within seconds, and new borrows are sized on the lower of the two, a price that is slow to rise and quick to fall:

\hat p = \min(p_{\text{symEMA}},\ p_{\text{dirEMA}})

Which price does what

Job	Price and depth used
Swaps and leverage entries	The live curve at current reserves
Borrow admission and stored collateral factors	A shadow constant-product tail at $\hat p$ , scaled to pessimistic depth
Lending liquidation eligibility	Collateral marked linearly at the symmetric EMA against the stored factor
Ordinary liquidation	Symmetric-EMA eligibility; atomic collateral-for-fixed-payment settlement
Emergency liquidation	Symmetric EMA and smoothed depth, separate from immediately manipulable spot reserves
hLP deposits and withdrawals	Cached settlement references with a divergence guard, 5% by default

Admission, eligibility and recovery use different valuations on purpose.

Admission is conservative so a loan is never larger than a stressed sale could cover. Eligibility is a smooth mark so healthy positions are not liquidated by a wick. External recovery is the liquidator's fixed-payment route; the internal fallback reconstructs execution from EMA and smoothed depth.

Cached risk books

A risk check does not read the spot price of the same transaction. Observations are cached, and the averages are rolled forward from those cached values, so a borrow or a liquidation cannot be steered by a swap placed in the same instruction. The same idea applies to the hLP settlement reference: a deposit or withdrawal is rejected when the spot has diverged too far from the cached reference, and asked to wait for a settlement.

Oracle-guided markets

A market can opt into one external price feed at creation. Its provider and feed cannot be replaced later. Its oracle policy names the feed and how far to trust it:

Setting	What it does	Bounds
Source	Pyth, or a provider's normalized report, as one feed for the pair or as a base and a quote feed taken as a ratio	Fixed accounts and feed IDs
Oracle weight	How far the curve's price moves toward the feed	Above zero and below 100%; zero is native pricing
Adjustment cap	The furthest the feed can pull the price from the native curve, either way	Above 1×; 1.25× allows 25% higher or 20% lower
Maximum age	How old a report may be, in seconds and in slots	Above zero
Maximum confidence	The widest confidence band accepted, relative to the price	Below 100%
Maximum publish skew	How far apart the base and quote reports may be published	Ratio sources only

Every price-sensitive instruction reads the feed accounts itself. It checks their owner, feed ID, age and confidence, and that the report is no older than the last one the market used, then prices on a guided curve. The guided marginal price is the native curve's price $N$ pulled toward the feed's price $O$ :

P = N \cdot \exp\!\Big(\operatorname{clip}\big(\lambda \ln \tfrac{O}{N},\ -\ln M,\ \ln M\big)\Big)

where $\lambda$ is the oracle weight and $M$ the adjustment cap. Inside the cap that is a weighted geometric mean of the two prices, $N^{1-\lambda} O^{\lambda}$ .

Oracle weight50%Adjustment cap1.25×

Guided price against the native curve, by where the feed sits

Guided price
The feed itself
Adjustment cap

Swaps, the moving averages, borrow admission, collateral values and hLP valuation all run on the guided curve, so the feed never values a loan on its own: it can move the curve's price only within the cap, and trades still pay price impact and fees along the curve's depth. A guided market's first deposit is priced at the feed rather than at a price the creator enters.

When a report is stale or fails a check, the instructions that depend on price fail with it: swaps, borrows, liquidity changes, collateral withdrawals, leverage actions and liquidations. Repayments and collateral top-ups keep working.

The provider and feed are creation-only. Operators cannot replace an unavailable source or use an oracle edit to bypass price checks.

What the market knows and what it does not

A native market knows its own trading history, and only that. An oracle-guided market also knows its feed, and inherits the feed's failure modes: a stale report stops price-sensitive actions until valid reports resume.

A thinly traded market has poorly informed averages; a brand-new market has averages equal to its opening price. Its accounting contains a loss inside the market that took the risk, but it cannot tell you the asset's fair value anywhere else, and it cannot promise that liquidity exists at a given price, only that the constant-product tail is never empty.

Choosing a half-life

The market creator sets the symmetric half-life from presets: seven minutes, thirty minutes, one hour or two hours, or any value between one minute and twelve hours in advanced mode. The effective lag before an average has caught up with a step change is roughly five to six half-lives. The operator or manager can announce changes later through the EMA half-lives family, subject to the full notice.