Oracle pricing
Every trade on diviko perps — opens, closes, liquidations — settles at the price reported by the oracle for that market. There is no order book, no last-trade price, no internal AMM. Prices come from outside the protocol.
This is what enables zero slippage. A trader cannot move the price by trading, because the price is not a function of trading; it is observed.
The price feed
Diviko perps consumes a composite feed for each market, built from two sources:
- A push oracle (Pyth) writes a fresh price on Zenith every few hundred milliseconds. The protocol reads the most recent on-chain price for routine operations like reading a position's unrealised PnL.
- A pull oracle (a signed off-chain price) is submitted by the trader, the keeper, or the closing party at the moment of execution. The protocol verifies the signature against the oracle's public key and uses the embedded price.
For an action to settle, the pull oracle's timestamp must be within a small window of the current block time (currently 30 seconds). The protocol then takes the worse of the push and pull prices from the user's perspective — bidirectional, so a trader opening a long settles at the higher of the two prices, while a trader closing a long settles at the lower.
Why the worse-of rule
Without it, a trader who saw a favourable off-chain tick could pull-submit it to open at a stale price while the on-chain price was already against them — a free option. Taking the worse of the two cancels the option: if either feed has moved against them, that's what they get.
The same rule applies to liquidations: a keeper liquidating a position uses the worse-of price for the trader. This makes liquidations slightly more aggressive but also more resistant to oracle manipulation: an attacker who briefly pumps the push price to trigger a liquidation will be defeated by the pull oracle (which they don't control).
Markout and the pool
Because there is no spread, the protocol's only protection against a fast-moving market is the staleness window and the worse-of rule. If either oracle is delayed past the window, the action reverts and must be re-submitted with a fresh price.
The DLP is effectively short the spread that a centralised market maker would have charged — it accepts trades at the mid and is compensated through fees rather than through edge. The fee schedule is calibrated so that, on average, fee revenue exceeds the markout cost of trading at mid.
Failure modes
If the oracle stops updating, the protocol pauses opens and closes until prices resume. Existing positions keep accruing borrow fees but cannot be liquidated; this is the conservative choice — better to delay a liquidation than to liquidate on a stale price.
A governance circuit breaker can pause individual markets if the feed is suspected of being compromised. While paused, the only allowed operation is adding collateral to existing positions.
Oracles are the trust assumption. The protocol's solvency rests on the prices being right. The provider is independently audited and operates redundant publishers; the worse-of rule limits the damage from any single bad print. But there is no on-chain price discovery here — diviko perps is a market that consumes prices, not one that produces them.