Skip to main content

Prices Come From In-Pool Trading

Oracles Are a Liability, Not an Asset​

Most on-chain derivatives protocols rely on external price feeds (oracles) for liquidation and valuation. This creates two structural problems:

  1. The attack surface moves outside the protocol — the oracle becomes an attackable component outside your contracts. Manipulating the instantaneous price of a thin spot pool can propagate through an oracle into massive bad debt for a lending protocol (Moonwell/MAMO: an 8x pump was used to borrow millions of dollars in mainstream assets; the Mango case is the same class).
  2. The list of things to trust grows — you must trust not only the contract code, but also the price reporters, the aggregation logic, and the node network.

Catswap's choice: the pool itself is the final source of price. Every price used for valuation, liquidation, and accounting derives from real trades in this pool — on-chain, verifiable, and immune to pollution from any external single point.

The Accounting Price: A Smoothed Trade Price, Not the Last Print​

Using the latest trade price directly for valuation would let a single large order punch through it. Instead, each pool maintains an exponentially weighted moving average (EMA) price benchmark: fresh trades flow in continuously, abnormal spikes are absorbed by smoothing, and fast wicks struggle to pollute the accounting price — while real, sustained trends pass through faithfully.

This anchoring system serves every price-sensitive part of the protocol:

  • Position valuation and PnL
  • Liquidation trigger decisions
  • Fee adjustment for abnormal trading

One anchor serves every scenario — no split-brain where "spot looks at one price, liquidation at another, risk control at a third."

No Oracle Is Not a Limitation, It Is a Choice​

For mainstream assets, others say "just connect a trusted oracle." We decline, for the reasons in the anti-manipulation philosophy: when every price judgment the protocol makes comes from inside the pool, and every manipulative trade pays the pool for the privilege, an attacker faces a closed loop of adversarial cost — not a system where finding one external weakness lets you bypass the entire defense.