PRICE LAYER
One price drives everything. Your challenge fill, your equity mark, the -4% daily and -8% total drawdown checks, the funding stamp, the liquidation trigger, and every leaderboard PnL number derive from the same published oracle mark. There is no "challenge mark," no "internal mark," and no private feed for funded accounts — a public wallet trading $100 of BTC and a 90 / 10 funded trader running $99 challenge size both price against the same Hermes/Pyth anchor and the same HTTP-mux cross-check. The whole prop layer would lose its meaning if the venue could quietly skew the mark in either direction, so the price layer is built to be reproducible by any reviewer from open data, not just believable from the inside.
Dexter cross-checks reference families first, then promotes a mark into executable venue state.
Main reference family.
Independent confirmation.
The engine trades the venue mark.
Reduced quorum only when allowed.
Every accepted mark is explainable.
The price layer owns five decisions: which references enter the venue, which reference path is active when multiple sources are healthy, how the executable mark is derived from that reference plus venue state, when a market must downgrade from live to reduced, close-only, session-closed, or halted, and which source posture gets stamped into the next settlement root so the contract layer can later prove which prices a payout depended on. Each decision is enforced before the mark becomes tradable — none of them are post-hoc disclosures.
| Price-layer responsibility | What it controls |
|---|---|
| Source intake | The whitelist of external publishers (Hermes/Pyth primary, HTTP oracle mux secondary) eligible to feed the venue |
| Source selection | The active reference path at every tick — driven by freshness, agreement, and deviation policy, not preference |
| Mark construction | Reference anchor blended with venue skew, spread, depth, max-move continuity, and prior-mark drift caps |
| Degradation logic | The trigger that downgrades a market to reduced, close-only, session-closed, or halted before risk checks misfire |
| Settlement context | The oracle-source hash committed inside each state root so payouts are bound to the same posture the trades priced against |
#From reference intake to executable mark
Normal production posture for every supported market is the same: Hermes/Pyth as the primary reference family running through a low-latency push channel, and an independent HTTP oracle mux providing a redundant pull path that the runtime cross-checks against every tick. The two paths must agree within deviation bounds before either can be promoted into the executable mark — a single source on its own is never sufficient under normal operation. This is the entire reason the venue refuses to treat "the price exists" as the same thing as "the price is tradable."
The runtime explicitly does not aim to maximize the number of contributing publishers. The aim is the opposite: hold exactly one defensible reference path live per market at any given second, with a pre-vetted ladder of fallbacks behind it for failover. When one family weakens — Hermes drops a publisher, an HTTP endpoint stalls, deviation widens beyond tolerance — the mux either swaps to the redundant path, restricts the posture, or pulls the market out of normal trading. Convenience is not a valid reason to keep trading on a thinned source set.
The engine then promotes the accepted reference into an executable mark instead of trading the raw tick. Reference anchor, venue skew, spread posture, depth checks, max-move continuity caps, and prior-mark drift bounds are layered together so the price the matching engine actually executes against reflects what Dexter can responsibly fill — not what the outside index happens to print at that instant. Funding, liquidation, and the rule-engine's drawdown checks all read the same executable mark. The full intake-to-mark policy lives on Sources and fallback; mark construction details and the parameter list live on Mark construction.
| Check | Purpose |
|---|---|
| Freshness window | A reference older than the per-market staleness cap is rejected before it can mark equity or trigger a stop |
| Source agreement and deviation bounds | Primary and cross-check must agree within the configured deviation band; a single rogue publisher cannot drag the mark on its own |
| Depth and spread checks | If the venue book is thin or the spread blows out, the mark is widened or the market downgrades — thin books never define executable price |
| Recovery lag | After a degraded or stale window, the market does not snap back to live the moment one fresh tick appears — a stabilization period must pass first |
external references enter
-> mux and source policy checks
-> freshness and deviation validation
-> mark construction from reference + venue state
-> market posture update
-> oracle-source context is published with the next settlement state#Price posture and session honesty
The freshness, agreement, depth, and recovery checks above feed directly into the market-state machine. Every Dexter market lives in one of five postures at any moment: live (normal two-sided trading), reduced (tighter caps, wider spread, lower max leverage), close-only (open positions can reduce but no new exposure), session-closed (off-hours for the underlying market), and halted (no execution, equity frozen at the last valid mark). These postures are not advisory labels — the matching engine, the rule engine, and the cashier all read the same state.
Crypto perps run 24/7, but equity perps, metal perps, and energy perps follow the underlying venue's schedule. A session-closed equity perp at 03:00 UTC is healthy; an oracle that lost its primary path at 03:00 UTC on BTC is degraded. Dexter deliberately separates the two so users, the rule engine, and the post-incident reviewer all see the same distinction: off-session is a clean state with a published reopen time, degraded is an open question that the venue is actively working through. The detailed session calendar and the live-to-halted transition rules are documented on Sessions and degraded states.
The active source posture — primary path identity, fallback engagement, deviation observed, freshness margin — is hashed into every settlement root the runtime publishes. The vault contract therefore knows not just what the balances were when a withdrawal request was included, but which oracle configuration produced them. A payout cannot be quietly settled against a different feed than the one your trades priced against, because the two are bound by the same root commitment.
#What this means for your PnL and payouts
- One mark, funded or public. A 90 / 10 funded account, a public wallet, and the leaderboard ranking engine all mark against the same Hermes/HTTP-mux executable price. There is no separate "prop feed" the platform could nudge to push an account into a -4% daily breach or out of the top 3 podium review — every challenge breach, every funding tick, and every PnL number is reproducible from public oracle data plus the published source-posture hash.
- Degraded posture freezes fresh risk, not your account. If primary and cross-check disagree beyond bounds, or freshness slips, the market drops to reduced or close-only. You can still cut size; you cannot add new exposure until the market promotes back to live. The rule engine stamps the degraded window onto your evaluation timeline so the -4% daily / -8% total drawdown checks are not triggered by stale prints — but trading capacity inside the 30-day window is not refunded.
- Session-based markets respect their schedule. Equity, metal, and energy perps move to session-closed when the underlying market is closed. Equity is marked at the last valid session price; the daily drawdown rule resumes at the next session open. Overnight oracle noise on an off-session market cannot fail your challenge.
- Settlement is bound to the same source posture. Every withdrawal release on Base is anchored to a state root whose oracle-source hash matches the posture your trades priced under. The cashier and the matching engine cannot diverge. Profit-share payouts target under 24h from request to USDC arrival; the proof-gated mechanics are documented on Settlement and withdrawals.