Area
Backend API / Soroban contracts
What problem does this solve?
Price and health score updates currently depend on individual price feeds or aggregated averages. If a subset of oracle price sources is compromised or experiences extreme flash crashes, single-source outlier prices can cause false circuit breaker trips or trigger unnecessary automated asset pausings.
Proposed solution
- Build a Byzantine Fault Tolerant consensus state aggregator in the backend (
bftOracleAggregator.service.ts) enforcing a $2f + 1$ quorum agreement across $3f + 1$ independent oracle providers.
- Implement median-of-medians filtering and weighted stake voting algorithms to reject malicious or out-of-bounds oracle price signals.
- Automatically flag and slash bad oracle nodes in database registry (
provider_health_registry) if their reported values deviate by $> 5\sigma$ from consensus.
- Integrate the BFT aggregator with the Soroban contract oracle module (
contracts/soroban/oracle_hub), submitting cryptographically signed multi-oracle aggregate state.
- Add unit and integration tests simulating Byzantine node behavior, network partitions, and malicious oracle collusion scenarios.
Alternatives considered
Simple arithmetic mean price aggregation, which remains vulnerable to extreme outlier manipulation from a single compromised feed.
Area
Backend API / Soroban contracts
What problem does this solve?
Price and health score updates currently depend on individual price feeds or aggregated averages. If a subset of oracle price sources is compromised or experiences extreme flash crashes, single-source outlier prices can cause false circuit breaker trips or trigger unnecessary automated asset pausings.
Proposed solution
bftOracleAggregator.service.ts) enforcing aprovider_health_registry) if their reported values deviate bycontracts/soroban/oracle_hub), submitting cryptographically signed multi-oracle aggregate state.Alternatives considered
Simple arithmetic mean price aggregation, which remains vulnerable to extreme outlier manipulation from a single compromised feed.