How Robust Price Indices Handle Bad or Manipulated Prices
Hyperliquid's robust price design uses multiple source and candidate prices so one bad exchange print, local trade, or model input is less likely to control the risk engine.
Price manipulation defense is an aggregation problem. If a risk engine trusts one source, corrupting that source can corrupt liquidations. Hyperliquid reduces this dependency by combining validator oracle submissions and multiple mark-price candidates, then using median-style selection. Robustness means one outlier is less powerful, not that pricing can never fail.
Source-level robustness
An oracle can aggregate several external spot venues rather than trust one exchange. Weighted-median logic is less sensitive to one extreme observation than a simple average.
Validator aggregation adds another layer: the chain consumes a consensus process around reference submissions rather than a single centralized feed.
Mark-level robustness
Even a correct oracle can lag a fast derivatives market. Hyperliquid therefore combines oracle and market-derived candidates for mark price. A median among candidates reduces the influence of a single distorted local or external component.
What if the whole market is broken?
No statistical method can infer a uniquely correct fair price when the underlying asset itself is undergoing a halt, depeg, exploit, migration, or fragmented price discovery. At that point, market operations and explicit risk decisions matter.
Robustness buys resistance to isolated bad data. It does not create truth from a market with no reliable reference.
How traders should monitor it
Track oracle-versus-mid and mark-versus-oracle deviation. Sudden persistent divergence can indicate stress, thin local liquidity, or source-market disruption.
For large leverage, treat unusual reference divergence as a reason to reduce size rather than wait for the liquidation engine to demonstrate which price wins.