> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hadron.fi/llms.txt
> Use this file to discover all available pages before exploring further.

# Risk Controls

> Staleness limit, drawdown guard, and factor clamp: what they do and where they stop

All three controls are off or neutral by default. Set them before the pool goes live.

## Staleness limit (`delta_staleness`)

If the oracle hasn't been updated within `delta_staleness` slots, swaps fail with `StaleOracle`, and
router adapters stop quoting the pool. If your crank crashes or your price feed dies, the pool stops
quoting instead of leaving a stale price for arbitrageurs.

* The default, `0`, means disabled: the pool keeps quoting its last price for as long as it sits.
* Up to 65,535 slots.
* Set by the quoting authority (`updateDeltaStaleness`).
* With a limit set, deposits and withdrawals on a pool with the drawdown guard on also need a fresh
  price; update the midprice in the same transaction.

## Drawdown guard

**TL;DR:** the pool pauses if it loses `threshold_bps` of its value within `rotation_interval_slots`.
The worst-case drain is `threshold_bps` per `rotation_interval_slots`.

The guard is a trip-wire against a recent peak. It's there to limit the damage if your hot quoting
key is compromised and starts pushing dishonest prices. It has two settings:

* `threshold_bps`: how much drawdown the guard tolerates before tripping. Drawdown is measured at the
  oracle price in base terms and in quote terms, and the two are added. A gain in one doesn't offset
  a loss in the other.
* `rotation_interval_slots`: how often the peak resets.

> **Example: a compromised key pushes the price 7%**
>
> Settings: `threshold_bps = 300` (3%) and `rotation_interval_slots = 1,500` (about 10 minutes).
>
> The pool holds 500,000 base and 500,000 quote at an honest oracle price of `1.0`, so its peak value is
> 1,000,000.
>
> The compromised key pushes the oracle price to `1.07` (+7%). The next swap, of any size and in either
> direction, checks the pool at that price:
>
> * In base terms: `500,000 + 500,000 / 1.07 ≈ 967,290`, about 327 bps below the peak.
> * In quote terms: `500,000 × 1.07 + 500,000 = 1,035,000`, a gain, which counts as 0.
>
> Total drawdown is 327 bps, which is over 300, so the guard trips and the pool pauses.

* A swap that would cross the threshold fills partially. It gets the largest output that keeps the
  pool within the threshold, as long as that meets the trader's minimum output, and the pool pauses in
  the same instruction. If the pool was already past the threshold, the swap fills nothing.
* Only the pool authority can restart a tripped pool.
* Set by the pool authority (`updateDrawdownGuard`). Disabled until you set it.

### Limits

* The guard only checks itself on a swap, a deposit or withdrawal, or a poke. A slow price drift
  during a quiet period can trip it on the next swap. Have your crank call `pokeDrawdownGuard` (signed
  by the quoting authority) at least once per rotation.
* Price moves count, not only trading losses. A move registers as roughly your inventory share times
  the move, even with no trades.

## Factor clamp (`combined_factor_max`)

The clamp is a hard ceiling on `price × inventory × base_spread` (see [the quoting equation](/makers/pricing.md#the-quoting-equation)).

* It defaults to `1.0`, so no fill is better than your oracle price, even if a curve, inventory skew or discount
  would price it there.
* It must be at least `1.0`. Raise it if you want to fill better than your oracle price on purpose, for example to
  attract rebalancing flow with an inventory curve above `1.0`.
* Set by the pool authority (`updateFactorClamp`).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.