Trading and the venue
Every fill on the desk, from a user buy to a forced sale, settles through one Router against one venue that is open continuously, floored at the Chainlink mark.
Always open
The venue is a set of on-chain pools, so it runs every hour of every day. There is no opening bell, no close, no holiday and no session the desk has to mirror: a buy, a sell, a swap, the daily charge and a forced sale all execute at 3am on a Sunday exactly as they do at noon on a Tuesday. Nothing in these pages is conditional on a market being open, because the market this desk trades on never closes.
One path for every fill
Buys, sells and swaps execute from inside your margin account: MarginAccounts holds custody, the Router takes the assets only for the duration of the fill transaction, and everything settles back into the same account atomically. A buy spends account USDG first and draws buying power for the remainder; a sell pays the debit first and credits any surplus as account USDG; a swap runs a sell then a buy in one transaction, with the margin test applied once to the post-swap basket. If any leg fails, the whole transaction reverts. Nothing partial ever settles, and nothing passes through your wallet mid-trade.
The minimum fill
The Router does not trust the venue's price. Before every fill it reads the Chainlink mark from the oracle hub, computes the fair quantity (for a buy) or fair value (for a sell), and applies the caller's slippage budget to produce a floor:
The floor rides into the venue as the swap's minimum output. A fill that would land below it reverts in full; there is no partial execution and no fallback price. The order ticket defaults the budget to 1.00%, and the protocol enforces a hard ceiling of 2.00% on every caller, protocol flows included. All budgets are listed on the Parameters page.
The venue: Uniswap v2
The live venue is a Uniswap v2 deployment with one USDG pool per listed asset. The pools follow a resting premium convention: each pool rests at the mark plus the 30 bps pool fee expressed as price. That convention makes the two sides asymmetric on purpose:
| Side | Cost against the mark | Why |
|---|---|---|
| Sell | Approximately zero before impact | The 30 bps fee cancels the 30 bps resting premium, so sells net out at the mark. |
| Buy | Roughly 60 bps plus impact | A buy pays the resting premium and the pool fee both. |
The ticket shows the quoted fill against the mark before you confirm, so the venue gap is never a surprise. On live chains, arbitrageurs hold the pools to this level for profit; on the testnet, the keeper plays that role, re-centring each pool after every feed refresh.
The desk marks your basket at the Chainlink price, not the fill price. The venue gap on a buy, premium plus fee plus impact, comes out of equity at the moment of the fill: you paid slightly more than the value the risk engine credits you with. The ticket states this before you confirm.
Protocol flows ride the same path
The daily charge's batched, netted sells and the forced sales of the call process execute through the same Router and the same pools as user trades, each under its own budget:
| Flow | Budget | On breach |
|---|---|---|
| User trade | User set, at most 2.00% | Revert |
| Batch sale, WEEK | 10 bps | Capitalise the charge, retry at the next daily charge |
| Batch sale, crypto and majors | 30 bps | Capitalise the charge, retry at the next daily charge |
| Batch sale, stock and ETF tokens | 50 bps | Capitalise the charge, retry at the next daily charge |
| Forced sale | 150 bps | Skip the leg, retry on the next sweep |
Every one of these limits sits below the user ceiling, so the ceiling check never blocks a protocol flow. Large forced sales unwind in capped clips, one fill per clip, each clip atomic under the same floor. See Interest and the daily charge and Calls and forced sales for how those flows are sized.
Halts and the venue seam
Each asset carries a halt flag on the Router, a guardian lever: while an asset is halted, no buy and no sell of it can settle, the daily charge capitalises that asset's share, and forced sales skip it. A halt is the only thing that ever closes an asset on this desk, it is deliberate rather than scheduled, and it applies to one asset at a time. Guardian pauses auto-expire, and anyone may lift an expired pause.
The venue itself sits behind a single adapter pointer. Swapping it is a wholesale governance action on the slowest timelock class: deploy a new adapter, point the Router at it, and every flow moves at once. The adapter is stateless, holds no funds between transactions and captures no fee, so there is nothing venue-side to migrate. A future aggregator adapter attaches to exactly this seam. See Governance for the delay classes.