Stress tests
The full maker (strategy, risk engine, executor, accounting, ledger) run through 22 failure scenarios in the simulator. Fail-safe means every invariant held: no risk taken under a blocking condition, no self-trades, no unauthorized transfers, books reconciled.
Fail-safe
22 / 22
| Scenario | Result | Maker P&L | Holding P&L | Maker drawdown vs holding | End state | Breakers that fired |
|---|---|---|---|---|---|---|
| Token −20% instantly | Fail-safe (6 checks) | −16.2% | −14.0% | −3.1% | making | extreme volatility |
| Token −50% instantly | Fail-safe (6 checks) | −34.4% | −27.5% | −9.9% | circuit break | oracle deviation, extreme volatility |
| Token −90% instantly | Fail-safe (7 checks) | −58.5% | −45.5% | −24.0% | circuit break | oracle deviation, max drawdown, max absolute drawdown, extreme volatility, inventory hard limit |
| Token +500% over two hours | Fail-safe (6 checks) | +194.7% | +220.1% | −8.2% | circuit break | extreme volatility, oracle deviation, max daily loss, inventory hard limit |
| Quote stablecoin depegs to $0.93 | Fail-safe (7 checks) | −4.3% | −5.0% | −0.0% | making | extreme volatility, quote depeg |
| Volume collapses to 2% | Fail-safe (5 checks) | −5.4% | −5.0% | −1.1% | making | inventory hard limit |
| Volume 20× | Fail-safe (5 checks) | +4.4% | −5.0% | −0.9% | defensive | inventory hard limit |
| 80% of external liquidity leaves the pool | Fail-safe (5 checks) | −3.3% | −5.0% | −0.4% | making | — |
| Venue reserves drained 30% | Fail-safe (7 checks) | −13.3% | −5.0% | −8.9% | circuit break | venue security incident, max daily loss |
| Oracle stops updating for 6h | Fail-safe (7 checks) | −4.2% | −5.0% | −0.9% | defensive | oracle stale, inventory hard limit |
| Oracle diverges from venue by 5% | Fail-safe (8 checks) | −4.1% | −5.0% | −0.3% | making | oracle deviation, extreme volatility |
| RPC outage: no transactions land, oracle unreadable (4h) | Fail-safe (7 checks) | −8.9% | −8.6% | −0.8% | making | oracle stale, execution failure rate, extreme volatility |
| 35% transaction failure rate (24h) | Fail-safe (6 checks) | −9.9% | −9.7% | −0.6% | making | — |
| Priority fees spike above mandate cap (12h) | Fail-safe (6 checks) | −6.8% | −6.8% | −0.4% | making | — |
| Steady decline accumulates base to the hard limit | Fail-safe (6 checks) | −20.4% | −16.2% | −5.2% | defensive | inventory hard limit |
| Token gains a freeze authority | Fail-safe (8 checks) | −5.0% | −5.0% | −0.2% | circuit break | unsupported token change |
| Mint authority changes hands | Fail-safe (8 checks) | −5.0% | −5.0% | −0.2% | circuit break | unsupported token change |
| Venue paused for 3h | Fail-safe (7 checks) | −3.7% | −5.0% | −0.6% | making | abnormal pool state, extreme volatility |
| AI supervisor unavailable; mandate requires it | Fail-safe (6 checks) | −4.4% | −5.0% | −0.2% | making | — |
| AI supervisor unavailable; mandate allows quant-only safe mode | Fail-safe (6 checks) | −4.0% | −5.0% | −0.9% | making | inventory hard limit |
| Quant engine unavailable (12h) | Fail-safe (7 checks) | −13.0% | −11.7% | −2.0% | making | extreme volatility |
| Unauthorized movement out of the vault | Fail-safe (7 checks) | −7.7% | −5.0% | −3.4% | circuit break | vault invariant |
Fail-safe is about control, not profit. In a sudden crash a concentrated-liquidity maker accumulates the falling token and can lose more than simply holding; the breakers stop new risk but cannot undo fills that already happened.