What makes the Rillor Compute Index hard to manipulate.

If you run risk or compliance at a venue, the question is not whether the Rillor Compute Index looks credible. The question is whether you can defend referencing it after a contested settlement, in front of a regulator, a counterparty, or your own board. That is a higher bar, and it is the right one. A reference price is only as good as the answer you can give when someone alleges it was pushed.

This piece sets out the specific design choices that make the index hard to move, and, just as important, the fields we publish so you can prove that to yourself on any given day. The short version: the index is built from executed, capital-backed forward contracts between KYC'd parties, blended over 30 days, with depth published alongside every print. There is no quote layer to spoof, no anonymous counterparty to wash against, and no single trade large enough to set the daily value on its own. Manipulation is not impossible (no benchmark can claim that), but it is expensive, observable, and self-defeating, which is the standard a serious settlement feed should meet.

The failure modes a reference price has to survive

Benchmark integrity is not a new discipline, and the canonical lessons are worth restating because they map directly onto how compute could be gamed. Libor failed because rates were set from voluntary submissions and expert judgment rather than from observable concluded transactions. When the input is an opinion, the input is manipulable, and the manipulation leaves no trade behind to contradict it. IOSCO's Principles for Financial Benchmarks were issued in 2013 in direct response to that scandal, and Principle 7 (Data Sufficiency) is the one a compute index lives or dies by: a benchmark should be anchored by observable transactions entered into at arm's length between buyers and sellers in an active market, formed by the competitive forces of supply and demand.

The second failure mode is newer and comes from crypto-native venues. There, the problem is not judgment, it is identity. Academic work on crypto wash trading documents how pervasive self-dealing inflates reported exchange volume, so a price can look deep and active while the depth is fictional. The trader on one side of a wash trade is the trader on the other side, and an anonymous, permissionless venue cannot tell the difference. The published estimate from that work is that wash trading averages over 70% of reported volume on unregulated exchanges, which is the scale of distortion an identity-free venue invites.

The Rillor Compute Index is designed against both of these. It takes no submissions and accepts no quotes, which closes the Libor vector. And it accepts trades only between independently verified parties, which closes the wash-trade vector. Those two decisions do most of the work. The rest of this piece is the detail behind them.

Executed contracts, not quotes, with capital at risk

The single most important property of the index is what counts as an input. The only thing that moves it is an executed Rillor forward contract: a standardized, bilateral OTC forward on a complete OEM GPU system, written for physical delivery. We covered the contract mechanics in Anatomy of a Rillor forward contract; the relevant fact here is that execution is not free. At execution, the buyer posts a 10% deposit into an independent escrow agent's account, and the seller is on the hook through a performance bond. The balance is due at delivery.

Think about what that means for an attacker. To print a price that drags the index, you cannot post a resting order at a fake level and pull it. You have to execute a real contract, which means putting 10% of notional into escrow held by a third party, with the other 90% owed if the trade stands. On a complete HGX B200 system, where a single eight-GPU node runs well into the high six figures and a fully built unit can clear several hundred thousand to over a million dollars depending on configuration, a 10% deposit on even a modest off-market lot is real money locked with a custodian you do not control.

That is the structural difference between a transaction-anchored benchmark and a quote-anchored one. A spoofed quote costs nothing and can be withdrawn in milliseconds. An executed Rillor contract costs a deposit you cannot easily recover and a delivery obligation you cannot wish away. This is exactly the property IOSCO Principle 7 is pointing at: the index is anchored by arm's-length transactions, not expressions of intent. For the field-level mechanics of how those contracts roll up into a value, see How the Rillor Compute Index is computed, field by field.

The 30-day rolling blend dilutes any single print

Suppose an attacker accepts the cost and executes an off-market contract anyway. The index is engineered so that one print, even a deliberately extreme one, cannot move the daily value materially. Each SKU's index value is a 30-day rolling blend of executed contract prices, not a last-trade snapshot.

The arithmetic is unforgiving for a manipulator. To shift a 30-day blend by a meaningful amount with a single print, the off-market trade has to be large relative to the entire trailing month of executed notional on that SKU, and it has to be far enough off-market to matter after that dilution. The cost scales with both. A bigger lot means a bigger deposit at risk; a more extreme price means a worse trade you still have to deliver into or default on, forfeiting the deposit and triggering the bond. The blend turns a one-shot attack into a campaign: to hold the index away from fair value, you have to keep executing off-market contracts day after day, each one bleeding capital, against a tape that is visible to every licensee.

This is the same logic that makes physical commodity benchmarks robust, and it is why we keep coming back to how mature markets price. The instructive comparison is not a crypto perpetual, it is Brent or the LBMA gold price. Windowed, transaction-anchored methodologies are boring on purpose. Boring is what you want under a reference price, because a window that absorbs any single trade is precisely what denies a manipulator the leverage a last-trade print would hand them.

Published depth, so you can reject thin prints yourself

Dilution only helps if there is real depth to dilute against. That is why the index does not ask you to trust the blend blindly. Every published value carries two depth fields you can read programmatically:

• constituent_trades: the count of distinct executed contracts inside the 30-day window for that SKU.
• constituent_notional_usd: the total USD notional of those contracts.

These are not decoration. They are the controls your risk team uses to decide, per SKU per day, whether a value is fit to reference. A licensee can and should set thresholds: do not settle a contract against a SKU whose constituent_trades is below your floor, or whose constituent_notional_usd is thinner than your model needs. If the depth behind a print is too low to be confident in, you reject the print, not the feed.

The contrast with the wider landscape matters here. The compute-derivatives products taking shape elsewhere reference rental-rate indices for spot compute, and they settle in cash. The Rillor Compute Index references executed forward contracts for the underlying hardware, and it publishes the depth behind each print so a licensee can audit it directly. The two answer different questions, and Rillor is deliberately on the physical-delivery side of the line. Rillor owns and controls the index and licenses it downstream as a settlement feed and API; it does not operate any cash-settled venue and never cash-settles its own contracts. A third-party exchange or fund that builds a cash-settled product against the feed gets a benchmark whose every print is backed by capital it can audit, rather than by quotes it has to take on faith.

KYC on both sides closes the wash-trade vector

A 30-day blend with published depth is still gameable if an attacker can manufacture depth cheaply by trading with themselves. This is precisely the crypto failure mode, where anonymous accounts wash volume back and forth to make a thin book look deep. Removing it is an identity problem, and Rillor solves it at the door.

Every buyer and every seller on Rillor is independently verified and KYC'd before they can execute. The platform captures the end-customer-of-record for the OEM's NVIDIA business unit on every contract, which is a hard requirement of NVIDIA channel compliance and a second, independent identity check layered on top of Rillor's own onboarding.

The consequence for manipulation is that you cannot be both sides of a Rillor contract anonymously. A buyer and a seller are two separately verified legal entities, each with a deposit or a bond at stake, each captured in the channel-of-record. Self-dealing does not become impossible (no benchmark eliminates collusion entirely), but it stops being free and anonymous. Coordinated wash trading would require two real, identified entities to repeatedly post deposits and accept delivery obligations on off-market terms, leaving a documented, KYC'd trail across the OEM channel. That is the opposite of the costless, identity-free wash trade that distorts unregulated venues.

Physical-delivery intent anchors prices to procurement

The reason none of this collapses into speculative churn is the nature of the instrument itself. A Rillor forward is a bilateral OTC forward written with the intent of physical delivery, qualifying under the CFTC forward-contract exclusion. The CFTC defines a forward as a cash transaction in which a commercial buyer and seller agree on delivery of a specified quality and quantity of goods at a specified future date, distinct from a standardized futures contract. The exclusion applies to commercial merchandising transactions that create enforceable obligations to deliver and are intended to be physically settled, with delivery deferred for commercial convenience.

That intent is not a legal nicety; it is a manipulation control. Because every contract is written to be delivered, the population of trades feeding the index is procurement, not position-taking. Someone executing a Rillor forward is committing to take or make delivery of real hardware (a Lenovo ThinkSystem SR680a V3 with NVIDIA HGX B200 180GB modules, say, or a Supermicro SYS-A22GA-NBRT or a Gigabyte G894-AD1-AAX5 node) at a real facility in a real delivery month. There is no offsetting your way out of the price discovery the way you can with a cash-settled future. The practical effect is that the tape stays tethered to what operators are actually willing to pay to deploy. Speculative noise, the kind that pollutes a churned book, simply does not enter, because a speculator has no reason to take delivery of a 1000W GPU system, rack it, power it, and cool it.

This matters more, not less, as the underlying market gets volatile. Blackwell spot rental prices have moved sharply, and a reference price has to stay coherent through that. A benchmark anchored to delivery-intended procurement absorbs volatility as signal; a benchmark anchored to costless quotes amplifies it as noise.

Seeded liquidity keeps the index from going thin

Manipulation gets easier as a market gets thinner, because dilution and depth-gating both depend on there being trades to dilute against and depth to gate on. A SKU with two contracts a month is more gameable than one with forty. This is the one structural risk that pure neutrality would leave open, and Rillor addresses it directly by participating.

Rillor is both the neutral operator of the marketplace and a seller and underwriter that seeds liquidity. On SKUs that would otherwise run thin, Rillor's own forward inventory keeps constituent_trades and constituent_notional_usd healthy, which keeps the index in the regime where the blend and the depth gates actually protect you. This is disclosed, not hidden: Rillor's participation is part of the design, and it is precisely why the depth fields are published, so a licensee can see the book is deep without needing to know which line is whose. Seeding liquidity does not let Rillor set the price, because Rillor's prints are subject to the same 30-day dilution and the same two-sided KYC as everyone else's; what it does is keep the population large enough that no one else can set the price either.

Stale-flagging and minimum-depth gating

The final control is honest signaling about when a value should not be used. Not every SKU trades every day, and a 30-day window can still thin out for a slow-moving configuration. When that happens, the right behavior is to say so, loudly, rather than to publish a confident-looking number off two stale contracts.

The feed does two things here. First, stale_flag marks any SKU whose window lacks fresh prints, telling a licensee that the value, while still computed, is no longer backed by current trading and should not be referenced for that day's settlement. Second, minimum-depth gating is built into the contract you sign as a licensee: below a defined floor on constituent_trades and constituent_notional_usd, a SKU is flagged as not settlement-grade for that day. Your venue's risk logic reads those flags and falls back to whatever your rulebook specifies (a prior settlement, a hold, a manual review), exactly as you would expect from any institutional reference price.

The principle is the one that distinguishes a benchmark you can defend from one you cannot: a good index tells you when not to trust it. Libor's defining flaw was that it always produced a number, with no signal that the number was unsupported. The Rillor Compute Index is built to flag its own thin days, because a settlement feed that hides its weak points is a liability to the venue that references it.

What this means for a risk team

If you are evaluating the index to reference it, the diligence reduces to a small number of checks you can run yourself. Confirm the inputs are executed contracts, not quotes (they are, and they carry escrowed deposits). Confirm the window dilutes single prints (it is a 30-day rolling blend). Confirm you can audit depth (read constituent_trades and constituent_notional_usd on every value). Confirm both sides are identified (two-sided KYC plus NVIDIA channel-of-record). Confirm the feed flags its own weak days (stale_flag plus minimum-depth gating). And confirm the population stays deep enough to make those controls bite (Rillor seeds liquidity, disclosed, on the same terms as everyone else).

The index is the durable asset in this market, owned and controlled by Rillor and licensed as a settlement feed and API. For a risk team, the moat and the manipulation resistance are the same fact seen from two angles: a benchmark anchored to capital-backed, KYC'd, delivery-intended contracts is hard to fake, which is exactly what makes it both defensible to reference and valuable to license.

If your venue is evaluating the feed for a cash-settled product, the methodology, the published fields, and the licensing terms are all on the markets page, and the full marketplace tape behind the index is at /marketplace.