Price regimes

Each branch computes a PriceView every hour from a composite of three groups of sources — the time-weighted averages of qualified on-chain pools, signed perpetual and index feeds, and twin-token markets where the same exposure trades under another ticker — and a sequence of validity checks. No group may weigh more than half the total. The question the view answers is not "is the market open" but "how well do we see the price, and what does that entitle anyone to do".

Fyber operates 24/7. Deposits, repayments and closures are open at every hour in every regime, without exception. What varies is how much new risk anyone may take, and what proof is required before someone else's position can be reduced.

The PriceView

struct PriceView {
    uint256 pComposite;  // median of the qualified source groups, recomputed hourly
    uint256 pDex;        // depth-weighted median of qualified pool TWAPs
    uint16  uBps;        // uncertainty on the true price, 1σ
    uint16  confBps;     // confidence, 0..10000
    uint16  bandBps;     // recognition band B, a constant equal to BAND_BASE
    uint256 pRef;        // valuation: min(pComposite, clampDown(pDex, B))
    uint256 pLiq;        // liquidation: pRef if the fall is confirmed, else pComposite
    uint256 pRedeem;     // redemption: max(pComposite, clampUp(pDex, B))
    bool    quietEdge;   // now < edgeUntil: the Stability Pool executes nothing
    uint64  edgeUntil;   // end of the current edge window
    Regime  regime;      // LIVE24 | DEGRADED | FROZEN
}

pLiq ≤ pRef is false the moment a fall is visible on-chain without being confirmed: valuation recognises such a fall, liquidation does not, so pLiq sits at the composite and pRef below it. The invariant reads pRef ≤ pLiq ≤ pComposite, and it is fuzzed in that form (Rule R-3.2.11, invariant I-2).

The three regimes

A source that goes quiet is not automatically a fault: a feed that only publishes on a 0.5% deviation is asserting that the price has not moved. Silence lowers confidence and narrows the set of groups that still count, rather than stopping the branch on its own. Only a missed heartbeat means a broken feed.

Confidence

σ is 20% on tier 1. DEV is the deviation trigger of the quietest source group, so the first hour of silence costs 50 basis points of certainty and no more.

g_dex is the only thing that can improve confidence, and it can halve the uncertainty at most. A pool qualifies when its one-hour time-weighted average is readable, its depth to a 2% sale is at least $500,000, and it sits within 3% of the median of the other qualified sources. Full credit needs $3,000,000 of qualified depth on tier 1.

What every rule does with it

FROZEN: the states that really have no price

FROZEN is reached by failure, never by the clock. Its causes are evaluated in strict priority, first match wins (Rule R-3.2.1, Rule R-4.2.1):

DELISTED > SEQ_DOWN > PAUSED > CIRCUIT > HEARTBEAT

SEQ_DOWN beats PAUSED because a sequencer outage invalidates the reading of oraclePaused() itself, and SEQ_DOWN exists only where an uptime feed exists.

Every exit is a set of conditions, never a fixed delay. A circuit breaker or a missed heartbeat clears on either of two paths (Rule R-4.6.2):

A source that publishes on a 0.5% deviation can take hours to produce a third round on a calm night, and the branch would then be held frozen at the worst possible moment: redemptions and liquidations both refused while interest kept running toward its 24-hour stop. Two rounds and an hour is the same evidence, gathered more slowly (decision D92). Whichever path clears it, the last consistent round becomes the accepted price and the quiet edge follows.

Three timers turn a frozen episode into an outcome, all of them automatic (Rule R-4.5.2):

Alongside the regime, the quote carries flags that modify permissions without changing it: preAction (a corporate action becomes effective within 24 hours), quietEdge (10 minutes after a composite that followed a long silence, or after an exit from FROZEN), dropConfirmed, mintFreeze, upgradeFreeze, closerFreeze, dormant and sunset.

Corporate-action pause

PAUSED carries the product promise around splits and dividends. The issuer's documented sequence is pauseOracle(), then updateMultiplier(new, effectiveAt), then unpauseOracle(). The adapter reads oraclePaused() through a staticcall capped at 30 000 gas, fail-closed: a failed call counts as paused (Rule R-2.4.3).

While paused, the branch values collateral at the pre-pause snapshot, taken by walking getRoundData back to the last round published before the pause was observed. Every round published during the pause is ignored. Borrowing, withdrawal, liquidation and redemption on that branch are refused; repayment, collateral addition and closure are open; the redemption router excludes the branch (Rule R-3.2.8, Rule R-11.1).

Leaving the pause requires oraclePaused() false, at least three fresh rounds, and the implied share price consistent across them with uiMultiplier() equal to newUIMultiplier() where both are readable. There is no fixed waiting period. The returning price then applies in one step, and the same 10 minutes quiet edge follows it as follows any exit from FROZEN (Rule R-4.6.3, Rule R-4.6.1).

The 24-hour preAction flag is separate: when effectiveAt() is less than 24 hours away, borrowing and opening are refused while everything else stays normal (Rule R-4.3.8).

Sequencer outage

If a Chainlink sequencer uptime feed exists on Robinhood Chain, its address is immutable in each adapter, and a non-zero status or a start time less than 30 minutes ago produces SEQ_DOWN. If no such feed exists, the address is zero at construction and the cause SEQ_DOWN does not exist at all (Rule R-3.2.10, hypothesis H4).

An earlier design used a substitute where no uptime feed exists: ETH/USD silent for more than two hours was read as a stopped sequencer. It was deleted for two reasons (decision D81). The risk it covered — a sequencer restarting with stale prices — is already covered by the staleness test that moves an old branch into DEGRADED with a haircut, by the deviation guard, and by the fact that feeds republish within a minute of a restart. And the substitute itself was dangerous: ETH/USD publishes on a 0.5% deviation and its heartbeat on this chain has never been measured, so a calm night on ETH would have frozen all twenty branches at once, stopping minting, withdrawal, redemption, the pool, and then interest at 24 hours, for a cause with no relation to equity risk. ETH/USD is still mandatory, for the single job of converting a pool quoted in WETH into dollars.

The quiet edge

When a composite returns after a gap, it applies in one step. pLiq becomes the composite at the moment it is accepted, whether it is higher or lower than what the branch had been reading. What follows is not a price adjustment but a window of visibility: for 10 minutes, the Stability Pool executes nothing (Rule R-3.2.5, Rule R-4.6.1).

The flag is set in two cases, each lasting 600 seconds:

1. On a composite that follows a long silence from the sources that feed it.
2. On every exit from FROZEN, whatever the cause: circuit breaker, issuer pause, missed heartbeat, sequencer.

During the window, flagging works, and minting, withdrawal and redemption follow their regime. Only liquidate waits. A position under its threshold at the new price is liquidated by the pool at edgeUntil, at that price, never higher.

An earlier design put a return ramp here. Over 900 seconds it slid pLiq from the old price down to the new one and let the pool buy at the intermediate value. That value was above the new price, so the pool burned X and received collateral worth less than X: measured at −3.4% after a −20% move, and at −13.8% leaving a circuit breaker, up to roughly $200,000 on a $900,000 pool. The liquidated borrower gained exactly what the pool lost and could execute the trade themselves. Ten minutes of nobody executing costs nothing and removes the whole class (Rule R-6.6.1, decision D79).

The deviation guard runs unchanged alongside it: a composite that moves further than its time-based budget produces CIRCUIT, not a new price.

Shutdown

DELISTED is entered by shutdown(), and it is final. Four causes (Rule R-6.9.1):

1. The branch's TCR has been below its shutdown ratio for at least an hour, observed by flagShutdown() and confirmed by shutdown().
2. A continuous frozen episode has lasted more than seven days.
3. The Closer called forceShutdown() during its lifetime.
4. A token upgrade freeze was never cleared and reached 28 days.

The effects are immediate: the adapter freezes at lastGood; a final accrual runs and the interest clock stops for good; borrowing, withdrawal, liquidation, rate changes and flagging are refused; repayment, collateral addition, closure, surplus claims and pool withdrawals stay open; the branch leaves the redemption routing and the aggregate TCR. Urgent redemptions open immediately for the mechanical causes, and seven days later for a Closer shutdown, so borrowers get a week to exit a decision that was not mechanical (Rule R-6.9.2, Rule R-6.9.3).

There is no relisting. A shut branch never reopens; a new branch on the same token is a matter for a future version of the protocol (Rule R-6.9.6).

Last reviewed: 2026-09-07 · Spec v0.4