> For the complete documentation index, see [llms.txt](https://ketro.gitbook.io/ketro-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ketro.gitbook.io/ketro-docs/oracle-and-trust-assumptions.md).

# Oracle and trust assumptions

### The price feed is the protocol's own

Collateral is priced from Polymarket's order book as **min(best bid, 1h TWAP)**, published on-chain by a push oracle the protocol operates. There is no decentralized feed for Polymarket outcome tokens; the protocol's backend is the only possible source. This page states plainly what that means.

* **Borrowing** uses the minimum over a trailing window — an upward move is ignored until it has held for the whole window; a downward move applies at once.
* **Liquidation** reads the latest price.
* The oracle **never rejects or clamps** a price. Rejecting an update freezes a lie on-chain; clamping an upward move holds the recorded price below reality and exposes borrowers to liquidations they did not earn. Large moves emit an event for alerting instead.
* A price older than its staleness limit blocks the actions that depend on it rather than being silently reused.

### What a dishonest operator could do

Publish a depressed price and liquidate a healthy loan. No part of the system prevents this cryptographically — signed prices would not help, because the same operator holds the signing key. This is a **stated trust assumption**, bounded in three ways:

1. **No profit motive** — liquidation pays the caller nothing and proceeds go to a timelocked treasury (see Liquidations).
2. **Timelocks** — reserve withdrawals, treasury repointing and any risk-parameter change that tightens against live loans are delayed by 2 days, and queued changes lapse after 5 more.
3. **The TVL cap** — exposure is bounded while the assumption stands.

### What is off-chain, and admits it

Two risk gates cannot be enforced on-chain, because the data is not there: minimum market volume, and UMA's resolution lifecycle. The backend polls them, blocks affected markets in the API and pages an operator — but the on-chain authority is the adapter's liquidity flag, moved only by its owner's key, which the backend deliberately does not hold. A UMA proposal opens a two-hour challenge window after which collateral is worth $0 or $1 with no price path in between; nothing timelocked can react inside two hours, and the design does not pretend otherwise.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://ketro.gitbook.io/ketro-docs/oracle-and-trust-assumptions.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.