The composite price

Spec v0.9.1, reviewed 2026-09-08

The exchange closes at night and at the weekend. The tokens do not: they keep trading on Robinhood Chain, on perpetual venues, and on other chains under other tickers. Fyber believes none of those markets on its own. It takes the median of several, weighted by depth, capped so that no infrastructure carries more than half of it, and clamped around the last exchange print it accepted.

Time enters this in exactly two places, both of them failure guards. Everything else is a function of what the sources say right now.

Rule R-3.2.1, principle P3

Families say what a source measures, groups say who signs it

A family answers "what market is this". Two sources of the same family are the same economic bet read twice.

A group answers "who produced this value". Two sources from the same group are the same infrastructure read twice, however different their markets look.

The anchor, and its two ordered feeds

Most branches carry two anchor feeds in a fixed order. The active one is the first that has published a valid round within 26 hours of open session time; if neither has, the branch halts.

GLD is the exception, and it is worth stating on its own. It has one session anchor, the signed one, because no exchange feed for it exists on this chain. There is nothing to switch to: if that feed goes quiet for more than 26 hours of open session, GLD goes straight to HALT.

The anchor has four jobs (Rule R-3.2.6). It is a source in its own right while it is fresh, meaning under 4 hours in a regular session and under 8 hours overnight. It is the reference the composite is clamped around. It is the base of the derivation ratios. And it is the price a halted branch displays. It is never, by itself, a liquidation price.

An anchor round that is more than 5% away from a composite of full quality is put in quarantine rather than accepted. After 3 quarantined rounds that agree with each other and still disagree with the composite, the branch freezes its liquidations and keeps everything else open. It does not close. A contradiction between the exchange and the live markets is a reason to stop selling people's collateral, not a reason to shut a branch (Rule R-3.2.5).

When no composite of full quality exists, the anchor is judged instead against its own last accepted value, with a budget that grows with elapsed time up to an absolute cap. A feed that jumps 12% with nothing to confirm it is invalid, and the branch halts until three consistent rounds bring it back.

Deriving a per-share source

An index perpetual quotes the index, not the token. Gold spot quotes an ounce, not a share of the fund. Each such source carries a ratio, snapshotted at every accepted anchor round when the source is fresh to within 900 seconds of it, and bounded to within a factor of 1.5 of its previous value.

The ratio absorbs, with no decision by anybody, the fund's net asset value drifting against its metal, the ratio of a fund to its index, a dividend on its ex-date, and a split through the token's multiplier. A source whose ratio is invalid is simply absent until the next snapshot.

Rule R-3.2.10

Quality, and the confidence it produces

Each source carries a quality q between zero and one. For an on-chain pool it is measured at every poke: the depth that moves the price 1%, divided by $2,000,000 for a fund or $1,000,000 for a single name. For a signed source it is fixed at construction from a measurement taken before deployment. For the anchor it is one.

A source below 0.10× does not count at all. Full price quality needs at least one source at or above 0.50×. Confidence reaches one when the summed quality reaches 2.0× and the family values agree.

Confidence never decays with time and never rises with a session. It is a function of how many independent sources answered, how deep they are and how far apart they sit. A source that comes back raises it at the very next poke.

The haircut reduces the value of collateral for borrowing and for withdrawing, and for nothing else. It never touches the liquidation threshold, and it never enters a branch-level condition.

Rule R-3.2.13, decision D80

The median, and the cap that keeps a group honest

Each family produces one value, the depth-weighted median of its own fresh qualified sources. Those family values then produce the composite, again by depth-weighted median.

Before the medians are taken, the group cap is applied. If one group's summed quality exceeds 49% of the total, every source in that group is scaled down so the group weighs exactly that much and no more. The median is the lower one, except that an exact tie is broken toward the anchor.

Worked on a measured Saturday morning for SPY: two on-chain pools at quality 1.0 and 0.95, an index perpetual at 1.0, a signed index at 1.0, and three twin markets at 0.3 each. The reporter group carries 45% of the total, so no scaling applies. Summed quality 4.55, dispersion between families 0.26%, confidence 0.91, haircut 1.0%, and the ratio a borrower had to clear was 126.5%, a limit of 79.0%.

Worked on AAPL, where the reporters carry three of the five venues: their raw weight reaches 51%, so the cap scales them down and the median lands on a group that is not the reporters. That is the cap doing its only job.

The clamp, and when it lifts downward

The composite is clamped around the anchor. Upward, always: 25% on tier 1, 35% on tier 2, 45% on tier 3. A composite above that ceiling does not raise anybody's collateral value and does not pay a redeemer more.

Downward the clamp is a circuit breaker against a fabricated fall, and it lifts when at least three signer groups agree to within 1%. Three independent infrastructures saying the same thing are better evidence than yesterday's exchange print, so a real 30% weekend fall is liquidated along the way rather than at Sunday's open.

With only two sources answering, the clamp is tighter and asymmetric: the composite is believed upward to 3% above the anchor, widening by one point every twelve hours of anchor age up to 8%. Downward it is not clamped at all — it freezes. Two sources saying minus fifteen per cent on a Saturday do not make the Stability Pool buy at minus four.

Three prices, never confused

The asymmetry is the design. Somebody who pushes the on-chain price up gains nothing, because valuation takes the lower value and redemption takes the higher. Somebody who pushes it down can only obstruct, and only positions already within the tolerated dispersion of their threshold.

The observer, and why it absents itself

On-chain pool prices are read by a shared observer, permissionless, one call per pool. Each observation truncates the recorded tick to at most 0.50% of movement from the previous one, no more than once per minute, into a ring of 128 observations. The time-weighted average runs over 1800 seconds.

A pool whose observations have all been clipped in the same direction 3 times in a row is saturated: the market is moving faster than the observer can follow, so the source absents itself rather than reporting a stale number. That is what happens on a real gap. When NVDA fell 17% in thirty seconds, its pool saturated within three minutes and dropped out; the branch went on liquidating at the true price on the three other groups, and the pool returned twenty minutes later.

The average is also refused if a gap between two observations exceeds 600 seconds, if coverage is short, or if the pool's liquidity has fallen by more than half against the median of the window. A provider who empties a pool invalidates it; they do not move it.

Rules R-3.20.1, R-3.20.2

The pull oracle, and the five reporters

Signed values reach the chain through one shared contract that knows no Fyber address at all.

The attestation path carries a Merkle root signed by the Wormhole guardians, plus the proof of each price message. The contract verifies the signatures, checks the emitter against two addresses fixed at construction, verifies the proof, and stores the value. The guardian set rotates by a governance message signed by the outgoing set, advancing the index by exactly one, with a 24-hour grace. No Fyber key is involved at any point. If that path stops working, the branches that depended on it live on their pools and their reporters.

The reporter path carries a bundle of individually signed prices. Each of the 5 keys signs its own reading of a public venue. A bundle is accepted with at least 3 signatures from distinct, unresigned keys, a minute-aligned timestamp, and a spread across the signed prices of at most 0.5%. The stored value is their median, so one liar among three to five is absorbed.

What an attack costs

The only way to profit from a false price is to be a Stability Pool depositor and push pLiq under the true price. The pool then buys collateral worth more than it pays, and the attacker collects their share of it.

Moving one family is not enough, because the median ignores the extreme family. On SPY, pushing the on-chain average down 4% means holding both pools at that level for roughly thirty minutes against arbitrageurs, which needs 20 to 40 million dollars of capital and costs 40,000 to 200,000 dollars in arbitrage losses. The attacker must simultaneously move the signed index and perpetual layer, where the order book absorbs several million dollars per percent and the mark is itself an average, or corrupt three reporters, whose group is capped below half. The cheapest second family costs 1 to 2 million dollars in slippage.

The gain is bounded by the positions sitting within the fabricated fall of their threshold, by the bonus, and by the attacker's share of the pool. On a branch at its last cap step, the whole prize is in the low tens of thousands of dollars against millions of dollars of cost. It is unprofitable by two orders of magnitude at every scale the caps allow, and the calculation is redone on a fork before deployment.

What is left is denial of service: sources that disagree freeze the branch, which stops liquidations, protects nobody's profit and is published by the watcher within minutes.

Rule R-6.5.5, Rule R-16.5.3

What follows from this page

• The four regimes this composite produces, and what each one permits: price regimes.
• The volatility measured on pRef and the borrowing limit it sets: volatility and the borrowing limit.
• What a borrower is told about it: your borrowing limit.
• What can still go wrong: price and oracle risk.