Pricing: signed index
Every trade settles at the Binance USDⓈ-M index price, signed off-chain and verified on-chain in the same transaction.
Source#
Settlement uses the Binance USDⓈ-M index price for BTCUSDT and ETHUSDT: a weighted index across major exchanges with public constituents and weights. It is quoted in USDT, the settlement currency, so no currency conversion is involved.
Signing#
An independent price signer, running on its own machine and holding no funds, signs every index update with its event timestamp using EIP-712 typed data. Updates are signed even when the price is unchanged.
On-chain checks#
Each batch pushes one signed price per market before any trade settles. The PriceOracle contract requires:
- a valid signature from the current price signer;
- a timestamp within the freshness window [now − 3,000 ms, now + 2,000 ms];
- a timestamp no older than the last price used for that market, which prevents replays.
If any check fails, the whole batch reverts and nothing settles. If no fresh signed price is available, nothing in that market settles until one is.
Example: freshness window#
A batch settles in a block with timestamp T. The relayer can attach any of the following signed prices.
| Signed timestamp | Rule | Result |
|---|---|---|
| T − 2.5 s | Not older than T − 3 s | Accepted |
| T − 3.5 s | Older than T − 3 s | Rejected; batch reverts |
| T + 1.5 s | Not later than T + 2 s | Accepted |
| T + 2.5 s | Later than T + 2 s | Rejected; batch reverts |
| Older than the last price used | No replays | Rejected; batch reverts |
accepted ⇔ T − 3,000 ms ≤ timestamp ≤ T + 2,000 ms
and timestamp ≥ last timestamp used for the market
← Scroll sideways for long formulas
A trade therefore always settles at a price observed no more than three seconds before its block.
Cross-check#
Before accepting opens, the relayer compares the signed price with the OKX index price. If the two diverge beyond a set tolerance, or either feed stops, opens in that market are paused. Closes and liquidations are not affected.
Verification#
Every signed price is published at /query/prices/signed, and every price used on-chain is emitted as an event. Both can be compared with Binance's public index price history.
Trust assumptions#
The contract cannot read Binance directly; settlement relies on the signer reporting the index honestly. There is one signer at launch. The guardian can revoke a compromised signer immediately; a new signer can only be set through the 24-hour Timelock. See Risks.