A dual-mode dynamic-fee hook that charges an IL-insurance premium only on the toxic flow that causes impermanent loss — priced off a de-trended oracle deviation, with every constant calibrated from real on-chain backtests.
Impermanent loss comes from the correcting direction of flow — the leg that pushes the pool back toward fair value. PegGuard charges its IL-insurance premium only on that leg. Benign flow pays the base fee and nothing more.
The premium is priced off a de-trended oracle deviation, and every constant is calibrated from real on-chain backtests — not a hand-picked guess.
Of every dollar of premium charged, the share that fell on genuinely toxic flow — precision — was measured by replaying 4,511 real swaps as regression tests against an oracle ground truth.
Slow basis must not be charged. Failing to de-trend the pool-vs-fair spread inflates apparent capture from the real 17% to a fake 224% — pure measurement artifact. PegGuard removes it with a ±300 s rolling median.
In the calm window, PegGuard returns net value to LPs across every swap-size bucket — and beats a static-fee pool on the same flow.
Honest read: in the volatile window net LP is −0.47 bps at the current 5 bps tier — see the base-fee finding below.
Profitability isn't a vibe — it's a base-fee-vs-toxicity question. For each window we measured the base fee a pool would need to break even.
At the current 5 bps tier, calm flow clears its bar with room to spare. Volatile flow needs slightly more — exactly the toxicity the premium is built to price.
Two safety systems sit on a minute-scale budget where cross-chain delivery latency is acceptable. Pricing stays on the 2–5 s Pyth hot path; Reactive Network drives the regime changes and breaker signals around it.
Normal stable-pair deviation runs 0.000–0.35 bps — below the ~0.2 bps feed noise. There's no directional fuel to harvest, so the hook charges no premium and arms the breaker only.
A 40 bps / 180 s trigger arms the volatile regime early. Across the calibration fixtures it fired with zero calm false positives and 6 volatile triggers.
Hot-path premium reads Pyth pull prices. The race clock is the pool's ~14 s update interval; Pyth at 2 s staleness keeps 88% of edge.
Regime changes, breaker signals and baseline upkeep tolerate latency — so Reactive Network belongs here, never in pricing.
The mechanism is bounded by hard rules and locked behind a parity-checked replay pipeline.
On any oracle fault or fee-calc edge, the hook degrades to the base fee. A swap is never blocked.
A ±300 s rolling median (τ = 450 s EMA) strips slow basis so only real, fast deviation is priced.
Tightening is immediate; loosening waits a 30 min disarm delay. Protection can only ratchet up fast.
Pyth confidence (~10 bps) dwarfs the ~1 bps signal, so a 3× EMA anomaly gate replaces absolute gating.
No magic numbers. Each constant traces to a sweep in the project's data/ directory.