The peg-risk oracle, now proven on-chain.
Pegana watches every Solana stablecoin, LST and synthetic for the moment it drifts off its peg. Every verdict re-derives byte-for-byte, by anyone — and severe transitions can be anchored on Solana mainnet, proven with a real receipt.
It isn't a claim. It's a transaction.
a real Depeg receipt · re-derivable byte-for-byte with pegana-replay
01 · Trust & methodology · v0.7.0
We rebuilt the minute that matters most.
A peg oracle earns its keep in the worst minute of an asset's life. This release rebuilt exactly that path — so a real catastrophe gets called, not buried under “data looks unreliable.”
| signal | what changed |
| black swan | A real collapse now reads BLACK_SWAN. A NAV-sanity guard was masking genuine >30% depegs as UNKNOWN, indefinitely. Now a sustained, hysteresis-confirmed collapse surfaces as exactly what it is. |
| oracles | Confirmed verdicts survive noisy oracles. Pyth confidence widens during the very volatility a crash produces. A confirmed verdict is no longer erased by the market stress that proves it real. |
| one path | One verdict, re-derivable three ways. The live engine, the offline replay CLI and the backtest re-derive the same verdict — byte-for-byte. Every severe alert ships a receipt anyone can reproduce and check against the chain. |
| staleness | Honest-dark when a feed goes stale. A new Pyth-confidence gate and a numéraire-staleness check mean a frozen or noisy feed reads UNKNOWN — never a confident, wrong PEGGED. |
02 · Security
The perimeter, tightened.
An adversarial audit closed the last outbound-request gap and hardened every delivery path an integrator depends on.
| signal | what changed |
| ssrf | Webhook DNS-rebinding, closed. Outbound webhook connects are pinned to the exact IP we validated, so a rebinding DNS can't swing a delivery to an internal host between check and connect. |
| delivery | Signed, redirect-locked delivery. Every webhook is Ed25519-signed and never follows a redirect — the two ways a delivery could be spoofed or bounced to an internal target stay shut. |
| recovery | Alerts are never silently lost. The dispatcher shuts down gracefully and recovers any in-flight alert stranded by a crash — no message read but never delivered. |
| secrets | Secrets stay secret. A credential guard blocks accidental key or secret dumps at the tool layer; the on-chain signing key is loaded, never logged. |
03 · The app, rebuilt
It won't show you a number it can't stand behind.
Front to back, the console and the public surfaces were reworked so freshness, honesty and reach match the rigor underneath.
| signal | what changed |
| freshness | A frozen feed can't fake a peg. Freshness gates across the dashboard, command palette and embed badges collapse a stale reading to UNKNOWN — the same bound, everywhere. |
| bands | Bands that track the live calibration. Every gauge, screener and alert preset reads the authoritative per-asset thresholds the API serves. Recalibrate once, and the whole UI follows. |
| mobile | Onboarding that meets you on mobile. The how-it-works walkthrough now opens on phones — the device most people arrive on — with a persistent way back to it. |
| the desk | Built for a desk, not just a glance. Portfolio CSV export, a real 52-week event heatmap, a device-local watchlist, and honest “heuristic, not a live verdict” labels where they belong. |
04 · Verifiable by anyone
The whole point of an oracle.
Every number above is checkable. The methodology is open, the receipts re-derive to the same bytes, and severe transitions can be anchored on a chain nobody controls.
Verify, don't trust
Don't take our word for it. Take the chain's.
cargo install pegana-replay