An oracle is the most dangerous dependency in any DeFi protocol. If the price feed is wrong, or slow, or manipulable, the entire collateral model breaks. Nest uses Pyth, and the reasons are specific.
Why equity oracles are harder than crypto oracles
Most oracle infrastructure was designed for crypto assets that trade continuously on global markets. US equities are different: they trade for 6.5 hours a day, five days a week, and they can be halted mid-session by exchange rules. The gap between the last traded price and the current fair value can be significant during premarket moves, earnings surprises, or halt events.
An oracle that simply reports the last traded price without expressing any uncertainty about that price is actively dangerous for equity-collateralized lending. A borrower whose collateral is an equity that halted after a bad earnings print might appear fully collateralized based on the last traded price while the actual reopening price is 20 percent lower.
Confidence intervals as a first-class feature
Pyth publishes a confidence interval alongside every price. That interval represents the oracle's best estimate of the uncertainty in the reported price at that moment. During normal market hours with active trading, confidence intervals are tight. During market closures, halts, or periods of thin volume, they widen.
Nest's liquidation engine uses these confidence intervals directly. When the reported uncertainty on a collateral's price exceeds the protocol's configured threshold, the engine suspends liquidations for that collateral type. This is not a soft warning. It is a hard circuit breaker that prevents the protocol from acting on a price it cannot trust.
Pull model, not push
Pyth operates on a pull model: prices are published to the Pyth network and pulled on-chain when a transaction that needs them is submitted. This design means price data is available at the moment it is needed, rather than relying on a keeper bot to push updates on a schedule.
For Nest, this matters most during liquidations. When a liquidation bot submits a transaction to close an undercollateralized position, the current price is pulled from Pyth in the same transaction. There is no window between the price observation and the liquidation execution where a stale cached value could be used. The price that triggers the liquidation is the same price the liquidation settles at.
Update frequency during market hours
During US market hours, Pyth publishes updates to its aggregate equity feeds approximately every 400 milliseconds. That frequency is fast enough that for any practical liquidation transaction, the price used is within a second of real-time. On Ethereum, where block times are 12 seconds and oracle updates follow the same cadence, a lot can happen in the gap.
Solana's sub-second finality and Pyth's sub-second update cadence are designed for each other. Neither works as well in combination with anything else.
What happens outside market hours
When US equity markets are closed, Pyth continues to publish price data for xStocksFi tokens based on available premarket, afterhours, or reference data, with confidence intervals that reflect the reduced certainty of those sources. Nest treats a confidence interval above its threshold as a signal to pause liquidations, not as a system error.
This behavior is intentional. The correct response to price uncertainty is to do nothing rather than to act on a number that might be materially wrong. Borrowers whose collateral is approaching the liquidation threshold during market closures are expected to add collateral or reduce debt before markets reopen.
No off-chain messaging dependency
Some oracle designs rely on off-chain messaging layers to relay prices between networks. Those layers introduce latency, custody of the price update, and an additional failure mode: if the messaging relay is congested or unavailable, price updates stop arriving.
Pyth's native Solana implementation has no such relay. Prices originate from data publishers, aggregate on the Pyth network, and are available on Solana directly. The protocol stack has one fewer external dependency, and one fewer thing that can fail.
See the Risk dashboard
Protocol collateral ratios, oracle confidence intervals, and recent liquidations are all visible in the Risk screen. Nothing is hidden.
Why Nest is built on Solana
The decision had nothing to do with chain preference. Tokenized equities live on Solana, fast settlement is required for equity-collateralized CDPs to stay solvent, and the entire dependent stack is native. Any other choice would have meant importing the asset class.
Why xStocksFi is the collateral
Nest needs collateral that is liquid, price-discoverable, and native to Solana. xStocksFi tokenized equities are the only asset class that satisfies all three without a bridge in the stack.
Why Kamino is the yield engine
The USDC sitting in Nest's Peg Stability Module has to be deployable without compromising instant redemption. Kamino is the only Solana lending market that combines the yield, the liquidity depth, and the atomic withdrawal guarantee the PSM requires.