CertOracle's three guards

Staleness: any price older than its heartbeat is rejected outright. Deviation: any print outside the guard bands against reference venues is rejected, even if it is fresh. Halt: an operator circuit breaker that freezes minting system-wide if the first two guards trip together. Three independent checks, each fail-closed.

Why minting pauses but redemption does not

Minting at a bad price manufactures unbacked certificates, which harms every existing holder. Redemption at the last good price simply returns margin that is already in the vault. One direction creates risk, the other releases it, so the guards treat them differently by design.

Last-good-price redemption

When the feed goes stale, redemption does not stop and does not guess. It settles at the most recent price that passed all three guards, with the timestamp printed next to it. You always know which price you were paid at and why.

“

A bad price is worse than no price.

Timelocked upgrades

Oracle parameters, guard bands, and contract upgrades all sit behind a timelock. Every change is announced on chain before it can activate, so there is a public window to review, object, or exit. Infrastructure that asks for trust should never be able to change the rules overnight.