Mark Price Construction & Price Bands
TL;DR
- Mark price is the price that determines your margin, PnL, and liquidation — it is deliberately different from the last traded price, constructed from an index price plus a smoothed premium to resist manipulation
- Price bands define the acceptable range around the mark price where orders can be placed and trades can execute — orders outside the band are rejected by the matching engine before they ever touch the book
- The premium measures how far an exchange's own order book deviates from the external index; it is smoothed over a time window (60 seconds on Backpack, 150 seconds on Hyperliquid, 2.5 minutes on Binance) to dampen spikes
- Index price clamping caps any single exchange's contribution — if Binance is 5% away from the median of all sources, its price gets clamped to the median +/- 5% before inclusion, preventing one compromised feed from poisoning the index
- Price bands interact with the premium in dangerous ways: tight bands designed to block manipulation can also reject legitimate trades when a genuine premium exists — a token trading at sustained +3% basis across all venues will have orders rejected if the band is set to +/- 2%
- The JELLY incident on Hyperliquid (March 2025) demonstrated what happens when price bands and oracle construction fail simultaneously — an attacker pumped a low-liquidity token 500% on external spot markets, distorting the oracle that fed into Hyperliquid's mark price, triggering $12M in liquidations against the HLP vault
- Static bands are simpler but worse — a fixed 5% band works for BTC but is too tight for a newly listed altcoin that legitimately moves 20% intraday; exchanges increasingly use tiered or dynamic bands that widen with volatility or narrow for majors
- OKX uses a 10-minute moving average of the contract-to-index spread to dynamically shift its price limits, allowing bands to track genuine market moves rather than fighting them
- The fundamental tradeoff is manipulation protection vs. price discovery — tighter bands prevent attacks but can freeze trading during legitimate volatility; wider bands allow real price discovery but open the door to manipulation
- Mark price construction is not covered in the oracle doc — the Price Oracle doc explains how index prices are assembled from external sources, while this doc covers what happens after the index arrives: how it becomes a mark price, how bands constrain execution, and the failure modes when these mechanisms interact poorly
1. From Index Price to Mark Price
The Price Oracle doc covers how index prices are built from 15+ external exchanges. This doc picks up where that one leaves off: once you have an index price, how do you construct the mark price that the engine actually uses for margin calculations, PnL, and liquidations?
The mark price is not the index price. It is the index price adjusted by a smoothed premium that reflects the supply/demand imbalance on the local exchange. The reason for this adjustment is practical: if the local order book is consistently trading above the index — because there are more aggressive buyers here than elsewhere — using the raw index would understate the fair value of open positions. Conversely, if the local book is persistently below the index, the raw index would overstate fair value.
The General Formula
Every major exchange uses some variation of:
Mark Price = Index Price + Smoothed PremiumWhere:
Premium (raw) = Local Mid Price - Index Price
Smoothed Premium = Moving Average of Premium over N seconds
Local Mid Price = (Best Bid + Best Ask) / 2The specifics differ by exchange:
| Exchange | Premium Window | Smoothing Method | Additional Logic |
|---|---|---|---|
| Backpack | 60 seconds | Simple moving average | Fallback chain if data insufficient |
| Binance | 2.5 minutes (150s) | 30 data points at 5s intervals | Median of 3 candidate prices |
| Bybit | 2.5 minutes | Moving average basis | Median of Price1, Price2, Last Traded |
| BitMEX | Continuous | Funding basis decay | Fair Price = Index * (1 + Funding Basis) |
| Hyperliquid | 150 seconds | Exponential moving average (EMA) | 1% per-tick clamp on mark price moves |
| OKX | Varies | Index + premium | Dynamic price limits using 10-min average |
Why Not Just Use the Index?
If the mark price were simply the index price, two problems arise:
Problem 1: Legitimate premium is ignored. If every trader on Backpack is bidding $101,000 for BTC while the index says $100,000, the true fair value for positions opened here is closer to $101,000. Using $100,000 as the mark would overstate the health of short positions and understate the health of longs — exactly backwards from what reality suggests.
Problem 2: Funding rate disconnect. The funding rate is calculated from the premium between mark and index. If the mark is the index, the funding rate has nothing to anchor to — it loses the signal about local supply/demand imbalance that the premium provides.
But the premium must be smoothed. A raw, instantaneous premium is trivially manipulable — a single large aggressive order can spike the mid price for a few milliseconds. The smoothing window (60 seconds, 150 seconds, etc.) ensures that only sustained deviations move the mark price.
2. The Smoothing Window: Design Choices and Consequences
The length and type of the smoothing window is one of the most consequential design decisions in mark price construction. It determines how quickly the mark price responds to genuine market moves — and how resistant it is to manipulation.
Short Window (e.g., 30 seconds)
Responsiveness: ████████████████████ HIGH
Manipulation Risk: ████████████████████ HIGH
Latency: ██ LOW
Trade-off: Tracks real moves quickly but a 10-second
spoofing attack moves the mark price meaningfullyLong Window (e.g., 5 minutes)
Responsiveness: ████ LOW
Manipulation Risk: ████ LOW
Latency: ████████████████████ HIGH
Trade-off: Extremely resistant to spikes but during a flash
crash the mark price lags reality by minutes,
potentially delaying liquidations that should fireThe Goldilocks Problem
Backpack uses a 60-second simple moving average. This means a 2-second price spike on the local book barely registers — it contributes 2/60ths of the average. But a genuine 60-second sustained premium shift is fully reflected.
Hyperliquid uses a 150-second EMA, which gives more weight to recent observations while still maintaining a long memory. The EMA is more responsive to sustained shifts than an SMA of the same length, because recent data points carry exponentially more weight.
Binance takes 30 data points at 5-second intervals over 2.5 minutes. This discrete sampling approach means a brief spike between sample points is entirely invisible to the mark price — it only sees snapshots, not the continuous stream.
How Binance Constructs Mark Price
Binance's approach is more elaborate than most. It computes three candidate prices and takes the median:
Price 1 = Index Price * (1 + Last Funding Rate * Time_Until_Funding / 8h)
Price 2 = Index Price + Moving Average of (Mid - Index) over 2.5 min
Price 3 = Last Traded Price (contract price on Binance Futures)
Mark Price = Median(Price 1, Price 2, Price 3)Taking the median of three candidates provides an additional layer of robustness. Even if one candidate is manipulated (e.g., the last traded price via a single aggressive fill), the mark price follows the middle value — which requires at least two of the three candidates to be corrupted simultaneously.
BitMEX's Funding Basis Approach
BitMEX pioneered a different model. Instead of adding a moving-average premium to the index, BitMEX computes a "Funding Basis" that decays linearly toward zero as the next funding timestamp approaches:
Funding Basis = Funding Rate * (Time Until Funding / Funding Interval)
Fair Price = Index Price * (1 + Funding Basis)This means the mark price on BitMEX gradually converges to the index price as each funding interval approaches — then resets when a new funding rate is calculated. The premium is baked into the funding rate itself rather than being a separate moving average.
The advantage: the mark price never drifts far from the index for long. The disadvantage: between funding intervals, a genuine sustained premium may not be fully reflected until the next funding rate calculation.
3. Index Price Clamping
Before external exchange prices are aggregated into the index, outliers must be detected and handled. This is the clamping layer — a protection against compromised or manipulated individual price feeds.
How Clamping Works
Step 1: Collect prices from all sources
Binance: $100,000 Coinbase: $100,050
Kraken: $100,020 OKX: $100,030
Bybit: $100,010 Bitfinex: $115,000 ← outlier
Step 2: Calculate median of all sources
Median ≈ $100,025
Step 3: Apply clamping threshold (e.g., 5%)
Upper clamp: $100,025 * 1.05 = $105,026
Lower clamp: $100,025 * 0.95 = $95,024
Step 4: Clamp outliers
Bitfinex $115,000 > $105,026 → clamped to $105,026
Step 5: Recalculate with clamped values
New average ≈ $100,856 (slight upward bias from clamped value)Different exchanges use different clamping strategies:
| Exchange | Clamping Method | Threshold |
|---|---|---|
| Backpack | Exclude sources >X% from median | 1-6% (tiered by market) |
| Binance | Clamp to median +/- 5% | 5% |
| Bybit | Exclude sources >5% from median; 1% for BTC/ETH | 1-5% |
| OKX | Exclude + adjust weights | Varies |
| Hyperliquid | Validator-submitted oracle, median of validators | Depends on validator set |
Backpack's Tiered Approach
Backpack uses different deviation thresholds depending on the asset tier:
Tier 1 (BTC, ETH, SOL, USDT): 3% max deviation
Tier 2 (BNB, DOGE, LINK, etc.): 4% max deviation
Established markets (4+ hrs old): 6% max deviation
New/small markets: 50% max deviation (permissive)This tiering exists because different markets have fundamentally different liquidity profiles. A 3% deviation on BTC almost certainly indicates a data feed problem — BTC simply doesn't diverge that much across major venues under normal conditions. But a newly listed small-cap token might legitimately trade at 20% different prices across exchanges due to fragmented liquidity and varying listing times.
The Problem with Clamping: Genuine Divergence
Clamping assumes that outlier prices are errors or manipulation. But what if one exchange has a genuinely different price because of localized supply/demand dynamics?
Examples of legitimate divergence:
- Regional premium: Kimchi premium (South Korea) or Coinbase premium (US) can persist for hours or days during periods of high retail demand
- Withdrawal restrictions: If an exchange halts withdrawals, arbitrage becomes impossible and prices can diverge from the global market
- Listing asymmetry: A newly listed token on one exchange but not others can show legitimate price differences
When clamping clips a genuinely divergent price, the index becomes inaccurate — it's smoothing over real information. There is no algorithmic solution to this problem. It requires human judgment: is the divergence a data feed error, manipulation, or reality?
4. Price Bands: The Execution Boundary
Price bands define the range around the mark price within which orders can be placed and trades can execute. Any order with a price outside the band is rejected before it ever enters the order book. This is the exchange's last line of defense against trades that would create positions at unreasonable prices.
How Price Bands Work
┌──────────────────┐
│ ORDER REJECTED │
│ (too far above │
│ mark price) │
└────────┬─────────┘
│
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Upper Band = Mark * (1 + cap%)
│
Acceptable Order Zone
│
── ── ── ── ── Mark Price ── ── ── ──
│
Acceptable Order Zone
│
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Lower Band = Mark * (1 - floor%)
│
┌────────┴─────────┐
│ ORDER REJECTED │
│ (too far below │
│ mark price) │
└──────────────────┘Implementations Across Exchanges
Binance uses a PERCENT_PRICE filter:
- Limit buy orders must be <= Mark Price * (1 + cap ratio)
- Limit sell orders must be >= Mark Price * (1 - floor ratio)
- Market orders are also constrained: if the best counterparty price exceeds the band, the order expires
- Cap and floor ratios vary by contract
OKX uses a dynamic band with a 10-minute lookback:
Max Bid = Min[Max(Index, Index*1.01 + AvgSpread_10min), Index*1.02]
Min Ask = Max[Min(Index, Index*0.99 + AvgSpread_10min), Index*0.98]
Where AvgSpread_10min = average of (contract OHLC midpoint - index)
over the last 10 one-minute candlesThis is clever: the band shifts with the 10-minute average spread between the contract and the index. If the perp has been trading 0.5% above the index for 10 minutes (a genuine premium), the upper band shifts up by 0.5%, allowing buyers to continue placing orders. But the band is still hard-capped at +/- 2% from the index, preventing extreme deviations.
Hyperliquid uses multiple layers:
- Mark price moves are clamped to 1% per tick from previous mark price
- Orders too far from oracle are rejected ("oracleRejected" error)
- All prices are clamped to 10x the start-of-day value (extreme safety net)
FTX (before its collapse) used one of the simpler approaches:
- Orders rejected if more than 10% from the 5-minute mean mark price for major assets
- Wider bands for smaller assets
Band Width by Asset Tier
In practice, exchanges use different band widths for different asset tiers:
Asset Tier Typical Band Width Rationale
────────────────────────────────────────────────────────────────
BTC, ETH ±1-2% Extremely liquid, tight bands safe
Major alts (SOL, etc.) ±2-5% High liquidity but more volatile
Mid-cap alts ±5-10% Moderate liquidity, legitimate swings
Small-cap / new tokens ±10-50% Thin books, wide legitimate range5. The Interaction Problem: When Bands Fight the Premium
This is where mark price construction and price bands create their most dangerous failure mode. The problem arises when:
- A genuine premium exists (the token is trading above/below the index across all venues)
- The premium is large enough to push orders near the band boundary
- The band is anchored to a mark price that lags the premium due to smoothing
Scenario: Genuine Market Decoupling
Timeline of a legitimate premium event:
T=0: Token trades at $10.00 across all venues
T=5min: Positive news breaks. Token jumps to $10.50 on all venues
T=5min: Index updates to $10.50 (external exchanges moved)
T=5min: Backpack mid price jumps to $10.80 (local demand spike)
T=5min: Premium = $10.80 - $10.50 = $0.30 (3%)
But:
60-second smoothed premium = only $0.05 (average of 5 seconds of
$0.30 and 55 seconds of old ~$0.00)
Mark price = $10.50 + $0.05 = $10.55
Price band (±2%): $10.34 to $10.76
Aggressive buyer wants to place a limit buy at $10.78
→ REJECTED: $10.78 > $10.76 (upper band)
T=6min: Premium persists. Smoothed premium rises to $0.15
Mark = $10.50 + $0.15 = $10.65
Upper band = $10.65 * 1.02 = $10.86
Now the $10.78 buy is accepted.The problem: for roughly 60 seconds after a genuine price move, legitimate orders near the new equilibrium get rejected. Traders see "order rejected: price too far from mark" and interpret it as the exchange being broken — when in fact the mark price is simply catching up to reality.
The Premium Feedback Loop
A more insidious version of this problem occurs when the premium itself is part of the mark price calculation:
1. Token has genuine +3% premium on local book
2. Mark price = Index + smoothed premium = Index + 1.5% (still catching up)
3. Price band = Mark ± 2% = [Index - 0.5%, Index + 3.5%]
4. Aggressive sellers want to sell at Index - 1% (reasonable based on index)
→ REJECTED: below lower band
5. Because sellers can't enter the market, the premium persists
6. Because the premium persists, the smoothed premium keeps rising
7. Eventually mark price overshoots as the full premium gets baked in
8. Now sellers can enter, premium collapses, mark price swings back downThis feedback loop — where the band prevents the very orders that would correct the premium, which in turn keeps the premium alive — is a real pathology that exchanges must carefully manage. OKX's solution of using a 10-minute moving average to shift the band dynamically is specifically designed to mitigate this: if the premium has persisted for 10 minutes, the band has already shifted to accommodate it.
6. Sustained Basis vs. Index: The Decoupling Problem
Sometimes a perpetual contract trades at a sustained premium or discount to the index for hours or days. This is not manipulation — it is a genuine market condition driven by:
- Leveraged demand imbalance: More longs than shorts on the specific venue, pushing the price above index
- Funding rate arbitrage: If funding is positive, arbitrageurs short the perp and buy spot, but if there aren't enough arbitrageurs, the premium persists
- Capital flow asymmetry: If a venue has inflows but no outflows (e.g., a deposit-only promotion), demand pressure creates a sustained premium
- Cross-venue latency: Different exchanges process information at different speeds; one venue's price might consistently lead or lag
The Problem for Price Bands
When a perp consistently trades at +2% to the index, a static price band of ±3% means:
- Buyers can only go up to index +3% (which is only +1% above the actual trading level)
- Sellers have room down to index -3% (which is -5% from the actual trading level)
- The band is asymmetric relative to where the market actually trades
This asymmetry constrains one side of the book more than the other, reducing liquidity and widening spreads on the constrained side.
How Different Exchanges Handle It
Binance's median approach: By taking the median of three candidate prices (one of which is the last traded price), Binance's mark price naturally tracks sustained premiums. If the contract consistently trades at +2%, the last traded price pulls the median upward, centering the bands closer to the actual trading level.
OKX's dynamic limits: The 10-minute moving average spread shifts the band to accommodate sustained premiums. After 10 minutes of +2% premium, the upper band has shifted up by +2%, allowing normal trading to continue.
Funding rate as self-correcting mechanism: In theory, a sustained premium generates positive funding — longs pay shorts — which incentivizes more shorts and fewer longs, pushing the price back toward the index. In practice, this self-correction can take hours or days, and the bands need to accommodate the premium in the meantime.
When Decoupling Is Real and Sustained
Historical examples of genuine sustained premiums:
| Event | Premium | Duration | Cause |
|---|---|---|---|
| Kimchi premium (2017-2018) | 10-50% | Months | Korean capital controls preventing arbitrage |
| Coinbase premium (2020-2021 bull) | 1-5% | Days/weeks | US institutional buying concentrated on Coinbase |
| GBTC discount (2022-2023) | -20% to -50% | Months | Redemption mechanism broken, no arbitrage possible |
| Post-FTX perp discounts (Nov 2022) | -2% to -5% | Days | Mass deleveraging, funding deeply negative |
Any price band system must accommodate premiums of this magnitude without rejecting all orders on one side of the book. The answer is either very wide bands (which reduce manipulation protection) or adaptive bands (which are more complex but allow both protection and accommodation).
7. The JELLY Incident: A Case Study in Price Band Failure
On March 26, 2025, Hyperliquid experienced a price manipulation attack on the JELLY (Jelly-My-Jelly) token that exposed fundamental weaknesses in how mark prices and price bands interact with low-liquidity assets.
The Attack
Phase 1: Setup
─────────────────────────────────────────────────────
Attacker deposits $7.17M across multiple accounts on Hyperliquid
Phase 2: Position Building
─────────────────────────────────────────────────────
Account A: Opens ~$4M short on JELLY perp
Account B: Opens ~$1.5M long on JELLY perp
Account C: Opens ~$1.5M long on JELLY perp
Phase 3: Oracle Manipulation
─────────────────────────────────────────────────────
Attacker aggressively buys JELLY on external spot markets
(primarily Bybit, which had outsized weight in oracle)
JELLY spot price: $0.008 → $0.051 (+537% in ~1 hour)
Phase 4: Cascading Failure
─────────────────────────────────────────────────────
Oracle price spikes → Mark price follows
Mark price rise → Account A's short gets liquidated
Liquidated short position → absorbed by HLP vault
HLP vault now holds a massive short at a loss
Attacker's long positions (B, C) → massively profitable
Phase 5: Resolution (Manual Intervention)
─────────────────────────────────────────────────────
Hyperliquid team manually settles all positions at $0.0095
(the attacker's short entry price, NOT the manipulated $0.50+)
Attacker withdraws $6.26M before funds frozen
JELLY delisted from HyperliquidWhat the Price Bands Should Have Prevented
The attack succeeded because several safeguards failed simultaneously:
- Oracle manipulation: JELLY had thin spot liquidity on external exchanges. Bybit's weight of 2 in the oracle (high relative to JELLY's actual liquidity there) meant pumping JELLY on Bybit alone was sufficient to move the oracle
- Mark price followed the oracle: With a 150-second EMA, the mark price tracked the pumped oracle with a modest delay — not nearly enough to resist a sustained pump
- Price bands were too wide: For a small-cap token, Hyperliquid's bands were permissive enough that the manipulated price was within bounds — the 1% per-tick clamp on mark price moves was overwhelmed by the sustained upward pressure over many ticks
- No open interest caps relative to oracle liquidity: The attacker was able to build $4M in short exposure on a token whose external spot liquidity was a fraction of that
Lessons for Price Band Design
The JELLY incident taught the industry several critical lessons:
Lesson 1: Band width must scale with oracle robustness. If the oracle for a token relies on thin-liquidity spot markets, the price bands must be tighter (not wider) — the exact opposite of the intuition that illiquid markets need wider bands to accommodate volatility.
Lesson 2: Position limits and price bands must be coordinated. No trader should be able to build a position large enough that manipulating the oracle is cheaper than the potential profit. The maximum open interest on a given market should be bounded by the cost of manipulating the oracle for that market.
Lesson 3: Manual intervention is not decentralization. Hyperliquid's decision to manually settle positions at a price chosen by the team — rather than the market price — was necessary to limit losses but fundamentally undermined the protocol's credibility as a decentralized exchange.
8. Static vs. Adaptive Price Bands
The simplest price band is a fixed percentage around the mark price: ±5%, done. But static bands are a blunt instrument.
Static Bands
Advantages:
+ Simple to implement and reason about
+ Predictable for traders
+ No edge cases from adaptive logic
Disadvantages:
- Too tight in volatile markets → legitimate orders rejected
- Too wide in calm markets → manipulation protection weakened
- Same band for BTC and a new memecoin → nonsensicalAdaptive Bands
Adaptive bands adjust their width based on some measure of current market conditions. There are several approaches:
Volatility-scaled bands: Band width = f(recent realized volatility)
Example:
BTC 24h realized vol = 2% → band width = ±3%
BTC 24h realized vol = 8% → band width = ±10%
Band width = max(base_width, k * realized_vol)
where k is a scaling factor (e.g., 1.5x)Time-since-listing bands: New markets get wider bands that tighten over time
Backpack's approach:
Market age < 4 hours: 50% deviation threshold
Market age > 4 hours: 6% deviation threshold (established)
Tier 1 assets (BTC): 3% deviation thresholdOKX's spread-tracking bands: Band shifts based on 10-minute average spread
Max Bid = Min[Max(Index, Index*1.01 + Spread_10min), Index*1.02]
If Spread_10min = +0.5%:
Max Bid ≈ Index * 1.015 (shifted up to accommodate premium)
If Spread_10min = -0.3%:
Max Bid ≈ Index * 1.007 (shifted down)Bybit's recent innovation: Starting November 2025, Bybit introduced a new clamping mechanism:
C = clamp(DeltaPrice / MaxDeltaPrice, 0.1, 0.9)
Where MaxDeltaPrice = R-minute maximum basis measured every secondThis normalizes the current deviation against the recent maximum deviation, ensuring the clamp factor is always between 0.1 and 0.9 — never fully passing through or fully blocking the deviation.
Comparison of Approaches
| Approach | Adapts To | Latency | Complexity | Risk |
|---|---|---|---|---|
| Static ±X% | Nothing | None | Minimal | Over/under-protection |
| Volatility-scaled | Realized vol | Minutes-hours | Low | Vol calc can be manipulated |
| Time-since-listing | Market maturity | Days | Low | Doesn't adapt to conditions |
| Spread-tracking (OKX) | Real-time premium | 10 minutes | Medium | Premium can be manipulated |
| Normalized clamp (Bybit) | Recent max basis | Minutes | Medium | Complex edge cases |
| Multi-candidate median (Binance) | Multiple signals | Seconds | High | Relies on diverse signals |
9. The Tradeoff Spectrum: Protection vs. Discovery
Every price band parameter sits on a spectrum between two competing objectives:
TIGHT BANDS WIDE BANDS
(Maximum protection) (Maximum price discovery)
◄────────────────────────────────────────────────────────────────────►
│ │
│ Manipulation nearly impossible Manipulation easier │
│ Legitimate orders rejected All legitimate orders work │
│ Liquidity constrained Full liquidity available │
│ Premium can't correct itself Premium corrects naturally │
│ Cascading rejections possible Cascading liquidations │
│ possible │
│ │
│ ◄── Sweet spot is here ──► │
│ (varies by asset, time, │
│ and market conditions) │Specific Tradeoffs
1. Smoothing Window Length vs. Responsiveness
| Window | Good For | Bad For |
|---|---|---|
| 30 seconds | Tracking genuine fast moves | Resisting short manipulation |
| 60 seconds | Balance for most markets | Slightly slow during crashes |
| 150 seconds | High manipulation resistance | Very slow during genuine moves |
| 5 minutes | Maximum resistance | Liquidations delayed, stale marks |
2. Band Width vs. Order Acceptance Rate
Band Width % of Orders Accepted Manipulation Risk
────────────────────────────────────────────────────────
±1% ~85% Very Low
±2% ~95% Low
±5% ~99% Moderate
±10% ~99.9% High
±50% ~100% Very High(Approximate figures — actual acceptance rates depend on market conditions and asset volatility.)
3. Clamping Threshold vs. Oracle Accuracy
A tighter clamping threshold (e.g., 1%) means the index is less sensitive to individual exchange outliers — but also less responsive when one exchange legitimately leads a price move. BTC on Coinbase often leads price discovery for US-session moves; clamping Coinbase when it deviates by >1% means the index lags the actual market.
The No-Free-Lunch Principle
There is no configuration of mark price construction and price bands that simultaneously:
- Responds instantly to genuine price moves
- Is immune to manipulation
- Never rejects legitimate orders
- Never allows abusive orders
Every exchange makes different tradeoffs along these axes. The "right" answer depends on the exchange's user base (institutional vs. retail), asset mix (majors vs. small caps), and risk appetite.
10. How Major Exchanges Compare
| Feature | Binance | Bybit | OKX | Hyperliquid | BitMEX |
|---|---|---|---|---|---|
| Mark price formula | Median(P1, P2, Last) | Median(P1, P2, Last) | Index + premium | Index + 150s EMA premium | Index * (1 + Funding Basis) |
| Premium window | 2.5 min (30 pts) | 2.5 min | Dynamic | 150s EMA | Funding interval |
| Index clamping | ±5% from median | ±5% (1% for BTC/ETH) | Varies | Validator median | ±5% from median |
| Price band type | PERCENT_PRICE filter | Slippage threshold | Dynamic (10-min avg) | 1% per-tick + oracle reject | Fixed bands |
| Band anchor | Mark price | Mark price | Index price | Mark price | Mark price |
| Adaptation | Per-contract ratios | New clamp (Nov 2025) | 10-min spread tracking | Per-tick clamp | Static per contract |
| Notable failure | None major | None major | None major | JELLY (Mar 2025) | Overload (Mar 2020) |
Key Architectural Differences
Binance is the most conservative. Three candidate prices, a median filter, and per-contract cap/floor ratios create multiple layers of protection. The cost is complexity — and the occasional "limit price can't be higher than X" error that confuses traders during volatile moments.
OKX is the most adaptive. The 10-minute moving average spread tracker allows the bands to follow genuine market moves while maintaining a hard ±2% cap from the index. This is arguably the most sophisticated approach for handling sustained premiums.
Hyperliquid relies on the 1% per-tick clamp as its primary defense. This works well for large, liquid assets where 1% per tick (every ~3 seconds) is fast enough to track genuine moves. It fails catastrophically for low-liquidity assets where an attacker can sustain a manipulated price for long enough that the 1%-per-tick ratchet brings the mark price to the attacker's target.
BitMEX pioneered the entire concept of fair price marking for crypto derivatives. Their funding-basis approach is elegant but less commonly replicated — most newer exchanges prefer the index-plus-smoothed-premium model because it's more intuitive and easier to debug.
11. Designing Price Bands for New Market Listings
New market listings are the hardest case for price bands. The asset has:
- No established price history
- Thin liquidity on external exchanges (if listed at all)
- Potentially no reliable oracle sources
- High legitimate volatility as the market finds an equilibrium
The Cold Start Problem
Day 0: Token launches. No index price sources.
→ Must use internal book prices only
→ Manipulation protection = near zero
Day 1: Token listed on 2-3 external exchanges.
→ Index has 2-3 sources (fragile)
→ Attacker can manipulate 1-2 sources cheaply
Day 7: Token listed on 5+ exchanges.
→ Index more robust
→ But price still volatile: 20-50% daily moves common
Day 30: Established market.
→ 10+ index sources, deep liquidity
→ Standard bands applyStrategies for New Listings
1. Progressive tightening: Start with wide bands (50%), tighten over hours/days as liquidity builds. This is Backpack's approach.
2. Position size limits: Cap the maximum position size relative to observable liquidity. If only $100K of spot liquidity exists on oracle sources, limit perp open interest to something proportional (e.g., 5x = $500K).
3. Isolated insurance pools: Bybit introduced this in late 2025 — new listings get their own $8M insurance pool, separate from the main fund, acknowledging that new markets generate more bad debt.
4. Higher margin requirements: Require more collateral for positions in new markets. If the standard maintenance margin is 3%, new listings might require 10%, effectively reducing maximum leverage and limiting the damage from any single liquidation.
12. Practical Implications for Traders
Understanding mark price construction and price bands has direct practical consequences:
Why Your Order Gets Rejected
If you see "order price too far from mark price" or similar errors:
- The mark price hasn't caught up to a genuine move. Wait 30-60 seconds and retry — the smoothed premium will update.
- You're trying to place an order far from fair value. This is the system protecting you (and other traders) from a fill at an extreme price.
- The oracle is lagging. External exchange data arrives every 2-5 seconds. During very fast moves, the index can lag by 5-10 seconds.
Why Your Liquidation Price Seems Wrong
Your liquidation price is based on the mark price, not the last traded price. If the mark price is significantly different from the last trade (because of the smoothed premium), your effective liquidation level may be higher or lower than you'd expect from looking at the chart.
Why Funding Rate and Mark Price Can Diverge
The funding rate is calculated from the average premium over the funding interval (typically 8 hours). The mark price uses the premium over a much shorter window (60 seconds to 5 minutes). During periods of fluctuating premium, the 8-hour funding rate can be near zero (premium oscillated around zero on average) even though the mark price moved significantly within the interval.
When Price Bands Hurt You
During genuine flash crashes or pumps, price bands can prevent you from:
- Closing a losing position if your close order would execute outside the band
- Opening a position to capture the move if the entry price is outside the band
- Having your stop-loss fill at the price you set (it may get rejected and re-queued at the band limit)
This is the price you pay for manipulation protection. The band is protecting the system as a whole, even when it inconveniences individual traders.
Key Takeaways
Mark price = Index + Smoothed Premium. The premium reflects local supply/demand imbalance, and the smoothing resists manipulation. Every exchange tunes the smoothing window differently — there is no universal correct answer.
Index clamping prevents poisoned feeds from corrupting the mark price. But overly aggressive clamping can ignore genuine price divergence, especially during regional premiums or exchange-specific events.
Price bands are the execution boundary. They prevent orders from filling at extreme prices, but they can also prevent legitimate trading during genuine volatility — especially in the first 60 seconds after a sharp move.
The interaction between bands and premiums is the primary failure mode. Bands that are too tight relative to a genuine premium will reject the orders that would correct the premium, creating a feedback loop that prolongs the deviation.
Adaptive bands are strictly better in theory but introduce complexity and edge cases. OKX's 10-minute spread tracking and Bybit's normalized clamping represent the current state of the art.
New market listings are the hardest case. Thin oracle sources, volatile prices, and low liquidity mean that no static band configuration works. Progressive tightening, position limits, and isolated insurance pools are complementary solutions.
The JELLY incident is the canonical failure case. It demonstrates that mark price construction, price bands, oracle robustness, and position limits must all be designed as a system — a weakness in any one component can be exploited even if the others are well-designed.
Related Docs
- Price Oracle — How index prices are assembled from external exchange data (upstream of everything in this doc)
- Liquidation Cascades — What happens when mark price moves trigger forced closures that move the price further
- Insurance Funds — The backstop when liquidations generate bad debt
- Circuit Breakers — Broader volatility controls, including why crypto largely lacks traditional halts
- Funding Rate — How the premium between mark and index feeds into periodic payments between longs and shorts