Skip to content
Fuga Labs
Scope an engagement
Sector preset

Perpetual venues

For venues that fail in one direction and fail fast, before a risk team has finished the first alert.

Scope an engagement Every sector preset
PresetonboardPerpDetectors in play5Boundaries declared3Refusals at onboarding0

How this sector loses money.

A perpetual venue fails in one direction and it fails fast. An oracle nudged inside a single transaction, a self-liquidation that pays the attacker out of your insurance fund, and a cascade that clears the book before your risk team has finished reading the first alert.

Answered by
  • 5Deterministic rules

What the preset configures.

One command, and this is its output. The identifiers at the foot are real, so you can diff them against the catalogue rather than trust the list.

onboardPerp(platform, config) 6 configured
  1. 01Every market contract monitored, plus the insurance fund as its own subject
  2. 02Funding-rate and mark-price integrity against declared oracle sources
  3. 03Liquidation cascade detection across markets rather than per position
  4. 04Self-liquidation patterns, where liquidator and liquidated are the same economic actor
  5. 05Intra-transaction price manipulation on the settlement leg
  6. 06Oracle feed health, including staleness and divergence
Detectors in play
  • rules.perp-market-anomaly
  • rules.liquidation-cascade
  • rules.self-liquidation
  • rules.oracle-feed-health
  • rules.intratx-price-manipulation

The perimeter, stated in writing.

Every edge, and the control that closes it. This is the list your auditor and underwriter will ask for, so it sits on the public page rather than an appendix.

The edge Order matching runs off-chain at most venues.
Closed by Closed from the settlement side. Intra-transaction price manipulation and funding-rate integrity are evaluated on the leg that actually settles, and the signed venue-feed lane correlates your off-chain events to it on occurrence time.
The edge Cross-venue manipulation needs a second venue to be visible at all.
Closed by Closed by declaring one. The preset configures cross-venue correlation as soon as a second feed exists, and says so plainly while it does not, rather than implying a coverage you do not have.
The edge The insurance fund is the thing an attacker is actually aiming at.
Closed by Closed by monitoring it as a first-class subject with its own invariants, not as a balance that happens to appear in a treasury report.

How it goes live.

Three rungs, in order, and each one written for this preset rather than for presets in general.

  1. Step 1

    Scope

    Every market contract, and the insurance fund enrolled as a subject of its own rather than as a balance in a treasury report. The oracle sources behind mark price and funding are declared in the same pass.

  2. Step 2

    Detect

    Cascade detection runs across the venue rather than per position, because the failure is correlated by construction. Intra-transaction manipulation is evaluated on the settlement leg, which is the leg that actually pays.

  3. Step 3

    Prevent

    The bounded action is a market pause on a named contract. Given how fast this class fails, the shadow period is the part worth arguing about, and the bar is agreed before anything is armed.

What runs underneath.

The breaker you own is the only shared piece fast enough for this venue class, and even then the shadow period is where the argument lives.

The base under all eleven presets

Scope Perpetual venues coverage.

Every engagement is scoped by the team, and onboarding is performed by operators. There is no self-serve door, and that is a security decision first.

Scope an engagement Every sector preset