The peg-risk oracle, now proven on-chain.
Pegana watches 68 Solana stablecoins, LSTs and yield-bearing tokens for the moment they drift off their peg. Every verdict re-derives byte-for-byte, by anyone . And severe transitions can be anchored on Solana mainnet, proven with a real receipt.
It isn't a claim. It's a transaction.
a real Depeg receipt · re-derivable byte-for-byte with pegana-replay
01 · V1 · live on mainnet
V1 is live.
Everything below this section shipped to production on 2026-07-23 and has been running since. 68 assets on the public peg surface. 72 in the canon, 69 active on mainnet, 56 fully calibrated.
| signal | what changed |
|---|---|
| systemic | What a depeg would actually liquidate. The new systemic view maps over $800M of leveraged collateral riding on these assets across Kamino and Jupiter Lend, and answers the question a risk desk actually asks: at a 500 bps shock, how much gets liquidated? Anonymous by construction. Distributions only, never a wallet. |
| calibration | 56 assets now fully calibrated. A batch recalibration promoted 36 assets from provisional to calibrated, with bands derived from their own observed 8-day distributions instead of hand-set defaults. |
| category | We stopped publishing a peg for something with no peg. A leveraged token trades far from its own NAV by design, so “market vs intrinsic” measures leverage, not peg risk. Publishing a peg verdict for it was a category error, so we removed it from the peg surface rather than explain it away. |
| real-time | The live feed, actually live. A compression layer had been corrupting the WebSocket upgrade handshake for browsers since May. Non-browser clients never saw it, which is why it hid so long. Fixed and verified in production; the feed streams every recompute. |
02 · For developers
Built to be consumed, and to be doubted.
The whole surface is public and keyless: 39 REST endpoints under one self-describing contract, a live WebSocket feed, and an MCP server so an agent can ask directly.
| signal | what changed |
|---|---|
| verify | Check any alert yourself, in 60 seconds. cargo install pegana-replay --locked, then point it at any alert id. It recomputes the receipt hash from frozen inputs and checks the on-chain anchor against a pinned signer. Not our word. Your machine's. |
| sdks | TypeScript and Python clients. Generated from the OpenAPI 3.1 spec, covering every endpoint, plus a hand-written helper for the live WebSocket feed in both languages. |
| contract | One response shape, everywhere. Every list endpoint returns the same envelope, every timestamp the same format, every decimal exact. Boring on purpose. An integrator should never have to special-case a field. |
| agents | An MCP server for agents. Ten tools, including receipt verification and the depeg-cascade simulator, metered per call in USDC on mainnet. No API keys. |
03 · Trust & methodology · v0.7.0
We rebuilt the minute that matters most.
A peg oracle earns its keep in the worst minute of an asset's life. This release rebuilt exactly that path. So a real catastrophe gets called, not buried under “data looks unreliable.”
| signal | what changed |
|---|---|
| black swan | A real collapse now reads BLACK_SWAN. A NAV-sanity guard was masking genuine >30% depegs as UNKNOWN, indefinitely. Now a sustained, hysteresis-confirmed collapse surfaces as exactly what it is. |
| oracles | Confirmed verdicts survive noisy oracles. Pyth confidence widens during the very volatility a crash produces. A confirmed verdict is no longer erased by the market stress that proves it real. |
| one path | One verdict, re-derivable three ways. The live engine, the offline replay CLI and the backtest re-derive the same verdict. Byte-for-byte. Every severe alert ships a receipt anyone can reproduce and check against the chain. |
| staleness | Honest-dark when a feed goes stale. A new Pyth-confidence gate and a numéraire-staleness check mean a frozen or noisy feed reads UNKNOWN. Never a confident, wrong PEGGED. |
04 · Security
The perimeter, tightened.
An adversarial audit closed the last outbound-request gap and hardened every delivery path an integrator depends on.
| signal | what changed |
|---|---|
| ssrf | Webhook DNS-rebinding, closed. Outbound webhook connects are pinned to the exact IP we validated, so a rebinding DNS can't swing a delivery to an internal host between check and connect. |
| delivery | Signed, redirect-locked delivery. Every webhook is Ed25519-signed and never follows a redirect. The two ways a delivery could be spoofed or bounced to an internal target stay shut. |
| recovery | Alerts are never silently lost. The dispatcher shuts down gracefully and recovers any in-flight alert stranded by a crash. No message read but never delivered. |
| secrets | Secrets stay secret. A credential guard blocks accidental key or secret dumps at the tool layer; the on-chain signing key is loaded, never logged. |
05 · The app, rebuilt
It won't show you a number it can't stand behind.
Front to back, the console and the public surfaces were reworked so freshness, honesty and reach match the rigor underneath.
| signal | what changed |
|---|---|
| freshness | A frozen feed can't fake a peg. Freshness gates across the dashboard, command palette and embed badges collapse a stale reading to UNKNOWN. The same bound, everywhere. |
| bands | Bands that track the live calibration. Every gauge, screener and alert preset reads the authoritative per-asset thresholds the API serves. Recalibrate once, and the whole UI follows. |
| mobile | Onboarding that meets you on mobile. The how-it-works walkthrough now opens on phones. The device most people arrive on. With a persistent way back to it. |
| the desk | Built for a desk, not just a glance. Portfolio CSV export, a real 52-week event heatmap, a device-local watchlist, and honest “heuristic, not a live verdict” labels where they belong. |
06 · Verifiable by anyone
The whole point of an oracle.
Every number above is checkable. The methodology is open, the receipts re-derive to the same bytes, and severe transitions can be anchored on a chain nobody controls.
Verify, don't trust
Don't take our word for it. Take the chain's.
cargo install pegana-replay