Running a HIP-3 market · Lesson 3 of 5 · 4 min
Running the oracle
The price is the one thing only you can supply, and the one thing that can liquidate every trader on your dex in a minute. This lesson takes a real update that did exactly that, second by second, then lists the ways an oracle goes wrong and the guards against each.
What one update carries
Every few seconds your oracle key signs a setOracle action for the whole dex. For each market it carries:
- the oracle price, your best view of the underlying (a stock, an index, a rate);
- your mark inputs, which Hyperliquid combines with its own book into the mark used for margin and liquidation;
- an external price, for example the same asset's perp on other venues.
Hyperliquid then lets the mark move at most 1% per update, one update every 2.5 seconds at most. That limit slows a bad price down. It does not stop it.
| UTC | Oracle sent by the operator | In won |
|---|---|---|
| 23:00:00.7 | $1,131.40 | ₩1,657,614 |
| 23:00:03.9 | $954.99 (−15.6% in one update) | ₩1,399,156 |
| to 23:00:39 | down 1% per update to about $870 | ≈ ₩1,275,000 |
| 23:00:39–23:02:00 | held near $870–874, updating every 3 seconds | |
| 23:02:03 | $1,078.70 (+23.5%) | ₩1,580,511 |
| to 23:04:03 | up 1% per update to $1,198.40 | ₩1,756,016 |
23:00 UTC is 8:00 in Seoul, the first second of the Korean pre-market. SK Hynix's range in Seoul's regular session that day was ₩1,550,000–₩1,674,000: the oracle went 9.7% below the day's low, then 4.9% above its high. The mark walked down 1% every three seconds, 961 long accounts were liquidated, and on the way back up 38 short accounts were liquidated too. trade.xyz's documentation now lists the pre-market as removed from its price coverage.
Every update and every liquidation: SK Hynix liquidation replay.
How an oracle goes wrong
| Failure | Example | Guard |
|---|---|---|
| One bad input passes straight through | SK Hynix, above | Take the median of several sources; hold the last price when they disagree |
| A session boundary | the first second of the Korean pre-market | Know each market's trading hours and holidays; decide what the price does while the underlying is closed |
| A corporate action read wrongly | Ventuals' SPACEX market fell 45% when a data provider mishandled a stock split; 405 traders were liquidated (The Crypto Times) | A calendar of splits and dividends; refuse moves no event explains |
| The feed goes quiet | any source, any night; past 10 seconds Hyperliquid falls back to its own mark | Resend the last good price while sources are stale; after a set time, halt the market instead of guessing |
| The rebound overshoots | $1,198, above the day's high | Apply the same checks on the way up as on the way down |
| Your updater dies | any process, any night | A standby that takes over when the primary goes silent |
Proving what went into the price
After an incident, traders and the validators who vote on slashing have only your account of what happened. A receipt for every update, listing the quotes it was built from and how it was computed, turns that account into evidence anyone can re-check. Try the receipts: honest ones pass, and a 0.05% cheat is caught in the browser.
- The oracle loop takes the median of fresh quotes, holds when sources disagree, and warns on any move over 1%.
- It knows trading sessions (US and Korean equities, with holidays) and what to do while the underlying is closed.
- When sources go stale it resends the last price, then requests
haltTradingonce, and never resumes on its own. - A standby takes over after 7 seconds of silence from the primary. Every update can carry a receipt.
Next: the limits around the price, and what Hyperliquid does to an account that crosses them.