Manipulation safeguards
Mimir combines onchain source checks, weighted aggregation and manipulation-cost estimates to give applications a price reference with clear risk information.
Why pool prices need protection
A trade can move a pool's price. In a thin pool, even a modest trade can move it a long way. An attacker may try to exploit that movement in an application that trusts the price.
Mimir pairs an inspectable onchain calculation with checks on liquidity, source diversity and price agreement.
Checks before a price is accepted
No pool manipulation inside the refresh transaction
The pool and vault accounts that determine the source price must be read-only in the refresh transaction. An attacker cannot modify those accounts and have Mimir read them in that same transaction.
This protection applies within the refresh transaction. Prices may reflect earlier trades, including within the same slot. The complementary liquidity and aggregation checks below help assess those inputs.
Liquidity must meet the feed's requirements
Mimir checks liquidity and depth: the modeled amount needed to move a pool's price by 0.5%. Sources below the configured requirements are rejected. Deeper usable liquidity generally makes moving the price more expensive.
Weight and independence matter
Mimir combines prices using a weighted median, rather than an average. The manipulation model considers an attacker influencing at least 50% of the effective weight. That means weight, not half the number of pools. An exact half-weight split uses the midpoint between the two boundary prices.
Sources assigned to the same liquidity-route group count once in effective weighting and attack-cost estimates. Grouping follows the configured routes; applications can also consider broader market correlations when selecting feeds. Multi-source feeds add protection through independent inputs: more genuinely independent liquidity can mean more markets an attacker has to move.
Disagreement can stop an update
When combining source observations over time (TWAP), Mimir excludes prices outside the allowed deviation from the median. If too few acceptable sources remain, it refuses the update. Source-count, diversity and liquidity requirements depend on the feed's policy.
These source and aggregation checks run in Mimir's onchain program, not just in the app interface.
Putting a cost on manipulation
Mimir calculates two different risk estimates onchain: the capital needed to influence enough source weight, and a minimum modeled economic loss based on pool fees. Capital required is not the same as money permanently lost.
From the capital estimate and configured safety parameters, Mimir derives a recommended exposure limit to help applications assess how much value to put at risk against a feed. Any DeFi application consuming the price should consider this estimate when setting its risk parameters. Integration remains permissionless: each application chooses its own exposure limits and risk policy.
These estimates help applications match their exposure to the feed's liquidity and source diversity. They complement the price's validity and freshness information when choosing risk parameters.
Next: audits and reviews, or freshness and invalid data.