Skip to main content
Hadron pools are designed so that the key doing the day-to-day work (pushing prices) can never spend your liquidity, and so that even a fully compromised operational key has a hard cap on the damage it can do.

​
Separated authorities

Keep authority cold: a hardware wallet or multisig that never touches a server. The crank only ever needs quoting_authority. If you follow one rule from this page, follow this one.

​
The guards

  • Drawdown guard. Caps how much the pool can lose over a time window. Even if the quoting key is fully compromised and pushes hostile prices, losses stop at the cap; your liquidity cannot be drained.
  • delta_staleness (staleness kill switch). If the pool doesn’t receive a price update within your configured number of slots, it stops quoting. A dead feed or crashed crank fails safe (no quotes) instead of failing open (stale quotes anyone can pick off).
  • Pause. pause_authority can halt the pool instantly, independent of the cold key.

​
What happens if…

Quoting stops automatically once delta_staleness expires, typically within a minute. No stale quotes, no losses; the pool simply goes dark until updates resume. Aggregators stop routing to you until then.
The attacker can push bad prices, but the drawdown guard caps total losses over its window, and the attacker cannot withdraw funds (that right belongs to other authorities). Pause the pool, rotate quoting_authority from your cold key, resume.
This is the failure the guards exist for: the drawdown guard bounds the damage while the bad feed persists, and pausing takes one transaction. For belt-and-suspenders, run sanity bounds in your crank config so implausible prices are rejected before they’re ever pushed.
Pause, withdraw both sides, done. The pool is yours alone: there are no other LPs to coordinate with and no exit process.

​
Programmatic control

Everything above is scriptable: see Admin controls for authority management and pool-state transitions, and Oracle Management for updateDeltaStaleness. Per-wallet and per-router quoting rules are covered in Toxic-flow prevention.