Slippage at size is not modeled
The Jupiter probe size is fixed per asset (~5M will be measurably worse. If you intend to act on Pegana state to execute a large trade, use Jupiter’s quote API directly at your real size.Single source per class
We deliberately do not blend prices. If Sanctum is wrong aboutsol_value for an
LST, every LST spread is wrong. If Pyth is wrong about SOL/USD, every USD spread is
wrong. If Hylo’s Exchange PDA decode drifts, hyUSD’s CR is wrong.
We accept this trade-off because reproducibility and clear failure modes matter more
than belt-and-suspenders robustness — but you should know it. For high-value
automation (insurance payout, liquidation), cross-check against your own oracle of
choice before pulling the trigger.
Thin venues lie
Even with Jupiter routing, an asset whose dominant venue dries up will print a crash-shaped spread that reflects venue stress, not asset stress. The mSOL/Pyth case is the textbook example. Mitigation: every asset has aconfidence field in the API. When market depth drops
below the configured floor, confidence falls and the consumer can choose to ignore
the print. The default cutoff is confidence > 0.9 to act.
Program upgrades
Any LST or CDP whose stake pool / vault is mid-upgrade may pause redemptions or change account layout. Our decoders are pinned to specific IDLs. IDL drift is the silent failure mode. We check pinned IDLs hourly against the on-chain canonical IDL; on divergence the asset flips toUNKNOWN and we emit a Sentry alert.
This means: if an LST is UNKNOWN for >15 minutes, it’s not a transient — go look at
the source.
Best-effort delivery
Alerts are best-effort. Telegram delivery is rate-limited by Telegram’s own API; in a burst (e.g., 22 assets transitioning at once during a market-wide event), delivery may take 10–30 seconds. Webhook delivery has 6 attempts with 5s / 30s / 5m / 30m / 2h backoff. If your endpoint is unreachable for the full retry envelope, the attempts are visible in/v1/me/webhooks/:id/deliveries and the event can be
replayed.
For mission-critical automation, poll /v1/assets/:symbol/state as a safety
net — that endpoint is the source of truth and is always reachable.
We do not score “predicted” depegs
Pegana publishes what is happening right now, smoothed by 30s of dwell. We do not project forward, do not score “likelihood of depeg in the next hour,” do not model correlation between assets. If you want forward-looking risk modeling, build it on top of our raw/v1/assets/.../history
data. We expose 1-minute aggregates and raw discount points for that purpose.
We do not arbitrate
When Sanctum’ssol_value says jitoSOL = 1.180 SOL and Jupiter’s routed quote says
1.176 SOL, the spread is -34 bps. We do not decide whether Sanctum or Jupiter is
“right.” We report the spread.
If you need a single “fair price” — i.e., a number to liquidate against — that’s a
different product. Pegana is the state oracle, not the price oracle.
Frozen / dropped assets
When an asset’s mechanism becomes untrustworthy, we freeze it. A frozen entry remains inassets.toml
for historical continuity but the engine no longer polls it. dSOL (Drift’s LST)
was frozen on 2026-04-02 after the 2026-04-01 exploit — no live counterparty for
redemption. It stays in assets.toml with active = false so historical snapshots
remain reproducible; it is excluded from the active 22 and no longer polled.
How to verify mistrust
Every alert includes theintrinsic_usd, market_usd, and discount values at the
moment it fired. Re-fetch the asset’s history endpoint around the alert timestamp: