Institutional Threat Model

Manipulated or stale price feed causes invalid liquidations or bad debt.

Multi-oracle median, TWAP fallback, deviation thresholds, staleness checks, circuit breakers.

Under-collateralized accounts create losses after rapid price movements.

Maintenance margin, liquidation penalty, insurance fund, leverage caps, open interest caps, dynamic margin.

Thin liquidity causes large slippage and liquidation cascades.

Dynamic margin, reduce-only mode, max skew limits, liquidity monitoring.

Contract bug causes loss of funds or incorrect accounting.

Unit tests, fuzz tests, invariant tests, internal review, external audit, bug bounty.

Privileged role misuse or compromised admin key.

Multisig, role separation, timelock, emergency-only controls.

Cross-chain bridge failure affects collateral or settlement flows.

Bridge limits, monitoring, withdrawal delays, exposure caps.

Liquidations do not execute during market stress.

Multiple keepers, incentives, monitoring, fallback liquidators.

Attackers manipulate order book, funding, or oracle-adjacent pricing.

OI caps, mark/index deviation controls, surveillance, dynamic funding.

Bad debt exceeds insurance fund balance.

Risk limits, liquidation penalties, dynamic margin, insurance fund monitoring.

Invalid or fake fills are sent to settlement.

Signature checks, nonce checks, fill IDs, settlement validation, public logs, future Merkle proofs.

Centralized matcher could censor or reorder trades.

Transparent logs, signed orders, verifiable fill batches, independent indexers, future decentralized operator set.

Matching layer outage prevents order execution.

Failover systems, reduce-only mode, public status page, operator redundancy.