Four prices, one median
Oracle plus a smoothed basisexternal spot, plus a 150-second EMA of this venue’s basis
This venue’s own bookthe mid of best bid and best ask
Oracle plus a funding basisderived from the funding rate
External perpetual midother venues’ perpetual markets
Median
Mark pricemargin · liquidation · unrealized P&L
The median is the whole defense: to move it you have to move at least two of four deliberately unlike inputs.
Price 1 — oracle plus a smoothed basis
This tracks whether this venue is persistently trading at a premium or discount to the outside market. The mid is the average of best bid and best ask. The smoothing is what makes it safe. A raw basis would move the instant someone widened or crossed the book; a 150-second exponential moving average means a manipulator has to hold the distortion for minutes rather than a block, which costs real money against everyone else who trades into it. Two details matter for anyone reconstructing this. The elapsed time in the EMA comes from block timestamps, not wall clock — so nodes agree. And after an unusually long gap, the large elapsed time causes the average to jump toward the current value rather than crawl, which is the correct behavior when resuming after a pause. What the smoothing actually does. Take a venue trading persistently above the index, so the basis walks from 0 up to 5 and then holds there:
Five minutes of a sustained 5-point basis moves the EMA to 4.62, not to 5. That lag is the protection: an attacker holding the book away from the index pays to hold it for minutes and still does not move mark price the full distance — while a genuine repricing, which persists, arrives in full soon enough to keep mark honest.
Every figure above comes from the formula as published. It is reproducible, and that is the point of publishing it.
Price 2 — this venue’s own book
The most direct reading of what is happening here, made resistant to two common distortions by taking a median rather than a single value: a single unusual print cannot move it, and neither can a momentary one-sided book.Price 3 — oracle plus funding basis
A perpetual trades away from spot in a way that funding explains. This price reconstructs that relationship from the funding rate rather than observing it, which makes it an independent check on the two prices that do observe it. Note the shape: the adjustment decays as the funding settlement approaches, reaching zero at the moment funding is charged. That is the same convergence the market itself exhibits.Price 4 — external perpetual markets
Deliberately different from the index price, which is built from spot. Perpetual markets carry basis and their own funding dynamics; including them means the mark reflects the instrument being traded rather than only its underlying. Weighting is by 24-hour volume across the reference venues, and which venues are included is configurable.Update timing
Mark price updates when the index price updates — roughly every three seconds, and within the same block, after the index. Ordering matters: a mark computed before its index would be one tick stale by construction. The EMA component is sampled every block, while the rest recomputes on the index cadence. If the index has not updated for six seconds, the mark updates anyway rather than growing stale alongside it.When inputs are missing
The design degrades in defined steps rather than failing.
The two-input case is worth understanding. Rather than fall back to a single source — which would hand exactly the control the median exists to prevent — the system manufactures a third input by smoothing its own book over 30 seconds. Shorter than the 150-second window used in normal operation, because in a degraded state responsiveness matters more; long enough that a single print still cannot dictate it.
Cold start
When a market first lists, three of the four inputs collapse to the index price: the smoothed basis starts at zero, the funding basis starts at zero, and this venue’s book has no history. The median of those is the index price. So a newly listed market marks at its index and diverges only as real trading accumulates — which is the correct starting point, since there is no venue-specific information yet to reflect.Where this is used
That last row is the one to internalize. Mark price never determines what you pay for a fill. It determines what your open position is worth, which is a different question and the one that governs whether you keep it.
Where to go next
Index price
The external reference the mark is anchored to.
Liquidations
What happens when mark price moves against your margin.
Funding
The premium mechanism that Price 3 reconstructs.
Oracle
How the index price is produced and certified in consensus.