Keeper overview

The protocol’s off-chain operator. It pushes prices, runs the bin books, settles committed orders and posts per-market parameters.

The keeper is an off-chain Rust service that the protocol runs. It pushes a reference price for each market, manages the 26 bin books, settles committed orders, moves inventory, and posts per-market parameters such as fees and the γ index. Its source code and binary are not published; these pages describe how the protocol’s keeper behaves and how it is configured.

Most loops have an environment switch, but not all. γ posting has no switch of its own and stops only if the whole book manager is turned off. Lending collateral, which happens only on mainnet, ships turned off. See Keeper configuration for variables and defaults.

What it runs

Task	Cadence	What it does
Price push	5 s in the deployed image (UPDATE_INTERVAL_MS, code default 15 s)	Fetches each market’s reference price, checks it against Hyperliquid, and writes it with mint-redeem update_risk_state_v2 to Market.user_twap_price (a spot price despite the name, 1e6, corporate-action adjusted) and twap_updated_at. If the source price is over 120 s old or the fetch fails, it withholds the push. 300 s after the last push, mint and redeem revert with TwapNotAvailable and the books switch to free float.
Book manager	30 s	Re-centres each book on its inventory-shifted centre once it drifts past the reposition gate, and posts the bin shape with set_pool_shape. See Book management.
Inventory	With the book manager	Trims asks above 1.5× the bid target. Each side’s bid cUSDC stays at the depth its next free-float book will post ($500 today): the excess is swept to the CLP vault, and bids that sellers spent are refilled from it (clp_fund_pool_usdc).
Parameter posting	With the book manager	Posts the mint and redeem fee, clamp(fee_mult × half-spread, 10, 100) bps (update_market), the committed-order spread, clamp(half-spread, 10, 500) bps (set_commit_spread), each market’s fixed overcollateralization target (set_buffer_target, only when it differs from the value on chain) and the γ index (set_s_gamma_index). Unposted γ is saved to R2 or DATA_DIR and survives a restart, and a market with no γ write for a day is posted once at least 1e-6 is pending.
Commit settler	20 s idle, 5 s while orders are pending	Finds pending committed orders and settles up to 10 per tick, largest first, simulating each settle first. A refund or a fill the CLP vault covers is sent as it is. A fill short of cash borrows from the treasury (allocate_to_market) and mints or redeems pairs if needed, in the same transaction as the settle where it fits, so a fill that fails takes its funding with it. Every settle passes the four exposure accounts (the pool’s long and short synth vaults, the CLP’s long and short token accounts), and a market’s exposure cap can turn a fill into a partial fill or a refund. Orders held back by the collateral floor or the oracle checks wait for a later push. It refunds expired orders about 5 s after expiry (cancel_swap). settle_swap is keeper-only. A payout or refund that can’t reach the owner’s recorded account leaves the order held, and the keeper then cranks claim.
Exposure caps	30 min	Posts each market’s nightly exposure cap to Clp.oi_cap (update_oi_cap) from the cr-targets file: decreases at once, increases only above 1%. A missing or stale file leaves the on-chain cap alone, and it never posts 0. EXPOSURE_CAPS_MODE is off, dryrun (the default) or live. See Solvency.
Short rebate	16 min	Runs refresh_rebate for every market’s short rebate, which is permissionless. With REBATE_MODE=live it also tops up each rebate pot from the treasury, to about a day of need whenever it holds under half a day, and never past the yield the market has harvested. REBATE_MODE is off, crank (the default, refresh only) or live.
Liquidity reallocator	30 s	Keeps each market’s CLP vault between its working need and twice it: what its bid refills can spend in one tick, $1,250 per market today (2 × $500 × 1.25). Tops up from the treasury below the need and returns everything above 1.5× once a vault passes twice the need (allocate_to_market, return_to_global).
Treasury backstop	With the reallocator	Tops up a market’s collateral from the treasury (backstop_market): at once below 100% at the stored price, and after 5 minutes short of its posted target by more than one confidence band. Fills to the target, at most 130% by default, and never takes a fill back. See Solvency → Treasury backstop.
Cross-market rebalance	With the book manager	Moves collateral from markets above their target ratio to markets below it (rebalance_collateral). It plans at the stored price the program checks and leaves the source one confidence band of margin. A destination within one band of its target is left alone, and past it is filled to target plus the band. Markets below 100% are filled first, and each source’s excess is split in proportion to need. The program clamps each move to what the source holds above its own target, so a plan made at an old price moves less than requested and never drains the source.
Redemption settler	60 s idle, 10 s while requests are pending	When REDEMPTION_SETTLE_ENABLED is true (default off), pays queued request_redemption requests in parts: from the vault’s cash, with a recall from lending venues in the same transaction, and with a treasury advance for the rest. It repays an advance from the market’s next recall. See Redeem.
Devnet treasury trim	5 min	Devnet only, and only when DEVNET_TREASURY_TARGET_USD is set: withdraws what the treasury policy’s allowance allows, never past the target, and burns it.
Health	300 s	Watches the SOL balances of both signers. Below a critical line it tops the wallet up (a devnet airdrop, a mainnet USDC-to-SOL swap of at most $250, or a transfer from the other signer) and posts a Discord alert if the wallet is still below.

The yield allocator runs every 300 s. It plans how much of each market’s collateral to lend, and where, from live mainnet state of three USDC venues (Kamino, Save and Jupiter Lend Earn; MarginFi is disabled). It lends only on mainnet with COLLATERAL_YIELD_ENABLED=true, which is off by default, and elsewhere it only plans. On devnet, an emulator credits each market the interest that plan would earn. See Keeper → Yield allocator.

Every transaction that moves funds is first written to a journal in R2 or on a persistent disk. If a send ends with an unknown outcome, the keeper pauses those sends until it has reconciled the transaction and restarted. Price pushes skip the journal because repeating one is harmless.

What it does not do

• Set prices by hand. Each half-spread is the largest of four terms: a realized q90 ratchet, a slow auto-floor based on 60-day volatility, oracle confidence plus a fixed cost, and a static per-market floor. No trained model, no discretionary input. See the keeper concept page.
• Sit in the user’s call path. mint_paired, redeem_paired, pool_swap, commit_swap and cancel_swap need neither keeper key. Mint and redeem do need a price push from the last 300 s. If the keeper stops, its last price ages past 300 s, and outside Normal the books then trade at their last posted bins. Anyone, the owner included, can call cancel_swap for an unsettled committed order once its 180 s TTL has passed, and the escrow goes back to the owner.

Signing roles

The keeper wallet is each market’s keeper_authority. It pushes prices, posts buffer targets and the γ index, rebalances collateral, and can call the keeper-only single-leg instructions (keeper_mint_single, keeper_redeem_single, keeper_burn_single). It could also move collateral to a keeper-owned account for lending (deploy_collateral_to_yield) on a market with yield_enabled set. Every live market has it set as of 11 Oct 2026, but the keeper lends only on mainnet.

The CLP authority signs book shapes, sweeps, inventory moves, set_commit_spread, update_oi_cap and, in live rebate mode, fund_rebate. Fee posting goes through update_market, which requires the market’s authority.