Pricing
Everything the desk does rests on one number: what a token is worth right now. If that number is off, the spread can't save it, the desk is just selling too cheap or buying too dear, and automated traders spot the gap in seconds. So most of the pricing work is spent making sure the number is right before a quote ever goes out.
The desk never trusts one source
The pricing engine is built around a venue interface, not a fixed list: any exchange behind that interface streams into the same pipeline, gated and routed the same way as every other. Binance, OKX, Bybit, Kraken, and Gate are connected today; onboarding the next one is adapter work, not a redesign, and the operator turns each connection on, off, or aside without touching the pipeline around it. Every incoming price is gated before it is believed: a tick that is too old is discarded, a price that jumped implausibly fast is discarded, a venue that keeps erroring is circuit-broken and sits out, and the operator can exclude any venue with one switch. Fair value is derived from what survives, routed to a live, healthy venue rather than averaged across all of them; when the routed venue degrades, pricing fails over to the next healthy one rather than freezing on a bad number.
Coverage varies by asset. ADA and ETH stream and hedge on all five connected venues today; NIGHT, being newer and less widely listed, uses three. Fewer venues is a thinner safety net, so NIGHT's exposure budget and concentration caps are watched the same as any other asset's.
What happens when the feeds fail
The desk tries three sources, in order. First, the live exchange feeds. If none of them can price a pair, it falls back to outside references (CoinGecko, CoinMarketCap) to work out a rate. There's a third option, a fixed rate set by hand, but it stays off unless someone explicitly turns it on. If none of the three produces a price the desk trusts, it doesn't quote. Skipping a trade costs nothing; quoting a wrong price costs money, and that trade-off decides every close call here.
Two checks before a trade is final
The price is read twice. Building a quote takes a moment, and the market moves in that moment. So the desk reads the rate at the start and again at the end, and if the two reads are more than 100 bps apart (the default), it drops the quote instead of sending a stale one.
The quote is re-checked when the order arrives. A user might sit on a quote for minutes before their order lands on-chain. In that gap they hold a free option: wait, watch the market, and only go through if the price moved in their favor, which means against the desk. The desk can't take that option away, but it limits the damage. When the order arrives, it compares the quoted rate against the live market and rejects the fill if it has drifted too far, with a tighter limit on moves that hurt the desk than on moves that don't.
Every decision is on file
Each quote keeps its own evidence: the two price reads, the venue behind each, the drift between them, and the full per-venue price table. It's all saved with the quote and visible in the operator console, so any pricing decision can be checked after the fact.