How the session works
Every risk parameter in Axle keys off the New York trading clock, and that clock is computed on chain rather than pushed by a keeper.
A tokenized share trades around the clock. The company behind it does not. On Saturday there is no price for Apple; on Monday the open can be ten percent away. A lending market that does not know this will lend against the token at the same LTV at 3am on a Sunday as at 10am on a Tuesday, and take the loss when the bell rings.
Axle computes the session from the Solana clock — the federal daylight-saving rule plus a holiday table published on chain — so it cannot be spoofed into or out of a liquidation. The code is programs/axle-oracle/src/calendar.rs, and the TypeScript in this page is a mirror of it that the tests hold to the same fixtures.
The underlying is trading and Pyth is publishing it live. Full LTV, market liquidations, full leverage.
Pre- and post-market. Pyth has stopped publishing, so the price is the token's own market with the last close as a ceiling. LTV is cut to 85% and leverage caps tighten.
The exchange is shut and the price is the token's own market, capped at the close. Positions can be reduced but not increased, LTV is 75%, and liquidations run as auctions.
Weekend or holiday. The token still trades and still prices you, capped at Friday's close. No new positions, LTV is 60%, and any liquidation is auctioned against the vault.
Where the price comes from
Pyth publishes US equities while the exchange is open and stops at the closing bell. This is measurable, and we measured it: at 20:10 ET every equity price account on Solana — Apple, Nvidia, Tesla, the S&P — carried a publish time of 16:00 and was four hours stale. There is no live institutional price for a US share for twenty hours out of every twenty-four, and none at all across a weekend.
So the session decides the source. Inside 09:30–16:00 the oracle requires a fresh Pyth print and refuses to price without one. Outside it, that last print is read as the close, and the live price becomes the xStock token’s own market, sampled by keepers from two-sided route quotes and published as a median.
The close is not just another input — it is a ceiling. Collateral marks at min(close, token), so a trader who spends real money pushing a thin pool up overnight moves nothing: their collateral is still valued at Friday’s close. Pushing the pool down works, but it only marks their own position down. That asymmetry is what makes it safe to price off an AMM at 3am.
The gap guard
For the first five minutes after the opening bell, market liquidations are suppressed and the Dutch auction runs instead. If the overnight gap exceeded fifteen percent, the auction holds for a full hour. A liquidator that hits a position in the first seconds of a gapped open is not providing a service — it is front-running the price discovery everyone else is waiting for.