Protocol Guard Rails

Drift Protocol's dependence on external oracle accounts requires thoughtful consideration of the data point in the streams received.

In the program [code], this is encoded as a spectrum from Valid to Invalid, with a few different categories of questionability that depend on the action taken (ordered by severity):

The processing of new data is as follows:

Processing data this way is meant to prevent a single new data point from creating a shock to the state variables (i.e. TWAP). A complete list of block conditions for actions is described here.

Notes:

For perpetuals markets, there are checks to validate_market_within_price_band for the following actions:

The check validates that the 5-minute oracle twap vs amm reserve price is within ~10% (see PriceDivergenceGuardRails for exact parameters).

Its important to note that:

1) amm reserve price always update with valid oracle data for amm and;

2) new data points for 5-minute oracle twap are sanitized to be within 10, 20, or 50% of the last twap value (depending on the ContractTier)

Thus, it may take multiple intervals to bypass these circuit breakers for sufficiently large price moves.

For spot markets, there are safety initial margin requirement checks for the following actions:

A user's asset / liabilities when calculating total collateral for initial margin checks for withdraws and placing orders will be the lesser / greater (respectively) of the 5-minute oracle twap and current oracle price. This lowers leverage extended by the protocol to users with positions in volatile markets.

ExchangeStatus and MarketStatus can be updated to prevent certain actions when specific issues are identified (described here). These actions can include: