Anti-manipulation

Depth Value is only useful if it cannot be pumped and borrowed against. Three contract rules make the value used for borrowing slow to rise, while health stays quick to fall.

The three rules

Rule	What it does	Parameter
1. Sounding window	The DV used for borrowing is the minimum of all recorded soundings over the window, not the instant value	15 min
2. Price cap	DV can never exceed qty × TWAP30 × 0.9	0.9 × TWAP30
3. Deposit age	A deposit counts toward the limit only after a delay	50 blocks (about 5 s)

Together they define the applied value used for limits:

applied DV = min(15-minute minimum sounding, qty × TWAP30 × 0.9)
limit      = 0.70 × applied DV of matured collateral

The example pool

All examples on this page use the same pool and the same position:

• Pool: 1,000,000 tokens and 100 HYPE, spot 0.0001 HYPE per token.
• 30-minute TWAP steady at 0.0001 HYPE per token.
• Position: 20,000 tokens.

Honest numbers for this position:

live sounding = 20,000 × 0.997 × 100 / (1,000,000 + 20,000 × 0.997) ≈ 1.955 HYPE
price cap     = 20,000 × 0.0001 × 0.9                                = 1.800 HYPE
applied DV    = min(1.955, 1.800)                                    = 1.800 HYPE
limit         = 0.70 × 1.800                                         = 1.260 HYPE

In a steady market, the price cap is usually the binding term for small positions. For large positions, depth binds. See Sounding.

Rule 1: the sounding window

The DV used for borrowing is minSounding(token, qty, 900): the minimum of the live sounding and the sounding recomputed against every snapshot recorded in the last 15 minutes, including the snapshot that was in force when the window opened.

Example

An attacker wants to borrow more against 20,000 tokens. They buy tokens from the pool to double the spot price. On a constant-product pool, doubling spot takes about 41.42 HYPE of swap input after the 0.3% fee, so the attacker sends about 41.55 HYPE. The pool now holds about 707,107 tokens and 141.55 HYPE (the fee stays in the pool), and spot is about 0.0002 HYPE per token.

The live sounding of 20,000 tokens is now:

20,000 × 0.997 × 141.55 / (707,107 + 20,000 × 0.997) ≈ 3.882 HYPE

If the protocol used the instant value with no other rule, the limit would be 0.70 × 3.882 ≈ 2.72 HYPE, more than double the honest 1.26 HYPE.

With rule 1, the 15-minute window still contains the snapshots from before the pump, each worth 1.955 HYPE for this position. The minimum is 1.955 HYPE, so the limit is at most 0.70 × 1.955 ≈ 1.37 HYPE. With rule 2 also applied, it stays at 1.26 HYPE.

To lift the window minimum, the attacker has to hold the doubled price for a full 15 minutes, with 41.55 HYPE sitting in a pool that anyone can sell into at twice the honest price.

Rule 2: the price cap

DV can never exceed qty × TWAP30 × 0.9, where TWAP30 is twap(token, 1800), the time-weighted average of recorded spot prices over 30 minutes.

Example

Suppose the attacker does hold the doubled price for 15 minutes, so every snapshot in the window now shows the pumped pool and the window minimum rises to 3.882 HYPE. The 30-minute TWAP is half honest, half pumped:

TWAP30    ≈ (15 × 0.0001 + 15 × 0.0002) / 30 ≈ 0.00015 HYPE per token
price cap ≈ 20,000 × 0.00015 × 0.9          ≈ 2.70 HYPE
applied   = min(3.882, 2.70)                ≈ 2.70 HYPE
limit     ≈ 0.70 × 2.70                     ≈ 1.89 HYPE

After 15 minutes of exposure and 41.55 HYPE committed to the pump, the limit has risen from 1.26 HYPE to about 1.89 HYPE: about 0.63 HYPE of extra borrowing.

The extra borrowing does not last. Health uses the live value, not the window. The moment the price returns, the live sounding falls back to 1.955 HYPE while the debt stays at about 1.89 HYPE:

health = (0.85 × 1.955) / 1.89 ≈ 0.88

That is below 1.00, so the Line can be trawled at once, and the Trawl sells the collateral to repay lenders. See Trawl.

New Markets

The price cap also protects new Markets. twap(token, 1800) returns 0 until the Market's oldest stored snapshot is at least 30 minutes old. With a TWAP of 0, the cap is 0 and nothing can be borrowed. The factory records the first snapshot when the Market is created, so a new Market cannot be borrowed against for its first 30 minutes. Creating a Market on a freshly pumped pool and borrowing straight away is not possible.

Rule 3: deposit age

New collateral sits in a pending bucket for 50 blocks before it counts toward the limit. On Elysium that is about 5 s, using the ArbOS L2 block number at about 0.1 s per block. A new deposit restarts the 50-block count for the whole pending bucket.

Example

A Line holds 20,000 matured tokens and has a limit of 1.26 HYPE.

Block	Action	Matured	Pending	Limit counts
N	Deposit 30,000 tokens	20,000	30,000	20,000 tokens: 1.26 HYPE
N	Borrow in the same block	20,000	30,000	still 1.26 HYPE
N + 30	Deposit 10,000 more; count restarts	20,000	40,000	still 1.26 HYPE
N + 80	Pending bucket matures	60,000	0	all 60,000 tokens

The 40,000 pending tokens mature at block N + 80, about 8 s after the first deposit, not at N + 50.

This rule closes same-block tricks. Flash-borrowed tokens must be returned in the same transaction, so they can never mature. A sequence that pumps the pool, deposits and borrows within one block gets no limit from the new deposit.

Fast down, slow up

The three rules apply to the limit, which decides how much you can borrow. Health uses a different value on purpose:

	Limit	Health
Sounding	15-minute minimum	Live
Price cap	0.9 × TWAP30	0.9 × TWAP30
Collateral	Matured only	All, including pending
Effect	Slow to rise	Quick to fall

A pump cannot raise either value quickly, and a real drop in depth lowers health in the same block. If the pool cannot be read, live value is 0.

What the rules do not stop

They make pumping expensive and short-lived. They do not stop a real, sustained move in a token's price or depth. If a token's liquidity leaves and stays gone, limits fall with it and Lines can be trawled. That is intended. See Risks.