Two clocks and a clamp
How the mark is set so one flash-loaned swap cannot settle a market.
5 min read · pre-launch
The legs are priced from AMM pools, and an AMM price can be moved for one block by anyone with enough capital for one block. Amphi settles on a mark that has to survive two checks.
Clock one: the median of three
mark = the middle value of the spot, the 30-minute mean and the last mark
The spot index read from both pools, the book's own 30-minute time-weighted mean of that spot (updated on every poke), and the last settled mark. To move the median, a manipulator has to move two of the three: the spot, and a mean that needs the false price held for half an hour against every arbitrageur on the chain.
Clock two: the clamp
a candidate further than 20% from the last mark settles at 5% of its distance
Anything closer settles at face value.A push past the clamp moves the mark by 5% of its distance in one step. A real repricing is confirmed push after push and converges within minutes; a one-block print moves settlement by at most 1% of what it intended.
- The dampened state is public: the terminal shows a pulsing fringe pill while a pair is dampened.
- Liquidations while dampened are priced off the dampened mark, never the raw push.
- Every open, close and liquidation pokes the mark first, in the same transaction. Nothing waits for a keeper.