deviant/Parameters/ASM_CrossChain/PriceOracles.md

Price oracles — reference for the cross-chain / Uniform Fiat covenants

Where the on-chain price truth comes from. The Uniform Fiat desk depends on two price inputs — an oracle-priced deposit (each stablecoin's market value, not par) and an FX rate per currency pair — and the FIATm/BCHm + AnyHedge work depends on a BCH/USD feed. This file is the single reference for the oracle networks we consume or could consume, their trust model, and the on-chain message formats. Primary BCH-native source: oracles.cash (General Protocols), already diagnosed by a prior session; the rest are listed as alternatives / source-chain options.

Location: Parameters/ASM_CrossChain/PriceOracles.md · linked from: UniformFiat/README.md, UniformFiat/architecture.md, UniformFiat/stablecoin-tracking.md, and each currency's stablecoins.md. Reference material — not investment advice; verify feeds before wiring.

---

1. The trust model (what an on-chain oracle actually is here)

A BCH price oracle does not decide anything — it only signs data. Each oracle is identified by its public key and publishes a policy (which pairs, what cadence, what source). It emits cryptographically signed price messages; an on-chain CashScript covenant verifies the signature with OP_CHECKDATASIG (checkDataSig in CashScript) and then applies its own logic. The oracle is a signaling machine with a bounded blast radius, never a price authority (fiatm-oracle-as-signaling-machine): the covenant (immutable on-chain) is the decision-maker, so a compromised or stale feed can only move value within the covenant's own guards (caps, band, pro-rata, the FIATm §12 confirmation logic).

The two residual risks, and the fixes:

Risk	What it is	Status
Forgery	a fake price	closed — checkDataSig against the oracle pubkey; BCH's NULLFAIL rule makes a non-empty-but-invalid signature abort the script outright
Single-oracle capture	one oracle lies within tolerance	closed (M5) — UniformReserve.deposit and .fxSwap require a 2-of-3 quorum over the attested value. Pass an empty datasig for a non-signing oracle (an empty sig is a clean "no" vote; a non-empty invalid one aborts). No single key can move the reserve.
Staleness	a genuinely-signed but OLD price submitted after the market moves	bounded (M5), not absolute — see below

The honest freshness position. A wall-clock "reject if older than N" is not expressible in BCH script: OP_CHECKLOCKTIMEVERIFY is a lower bound only — you can prove time has passed, never that it has not (the same recorded finding as "fee escalation isn't enforceable, decay is"). What is enforced:

• Outpoint binding — every attestation names the current controller outpoint, so it is single-use and invalidated by the next spend of that controller (deposit, withdraw, writedown, setPause, fxSwap). The staleness window is therefore "until the controller next moves" — short on a busy desk. Tested: an attestation held across one intervening deposit is rejected.
• A maxPrice sanity ceiling + an amount ≤ 9e18/maxPrice int64-overflow guard, so even a fully-compromised quorum cannot credit an absurd value or overflow the arithmetic.
• The covenant's own guards — per-cell caps, the band, pro-rata redemption, pause — keep the blast radius bounded regardless of the feed.

The signaling controller — fast, by median rather than by delay (M5 slice 2, built)

The original FIATm §12 framing bought outlier rejection by paying latency (EMA + multi-block confirmation). That trade is unnecessary, because the two jobs separate:

question	answered by	cost
"is this an outlier?"	the cross-sectional MEDIAN across N independent oracles	zero lag
"is this move sustained?"	a short confirmation streak	a few ticks only

Staggering supplies the speed: N oracles each on period T, phase-offset by T/N, give an aggregate cadence of T/N without any oracle polling faster —

config	per-oracle period	aggregate cadence	tolerates	decision
4 oracles × 60s	60s	15s	1 bad feed	60s
5 oracles × 1min15s	75s	15s	2 bad feeds	60s
6 oracles × 60s	60s	10s	2 bad feeds	60s

All three decide in 60 s — 10% of a 10-minute budget. Verified (scripts/sim-fiatm-controller-fast.mjs): a 39% wick on one feed is rejected on the first tick with a median (error 0.00%), while a mean is contaminated 6.48% and an EMA only dilutes it while taxing every genuine move with 5–29 ticks of lag.

Fail-safe: too few fresh samples ⇒ HOLD the last published rate; never publish a thin or stale one. Implementation: services/uniform-oracle/controller.mjs (off-chain — the covenant is at the 1650-byte limit and already ratifies the aggregate via its 2-of-3 quorum), gate test/uniform-controller.test.mjs (7/7).

Honest caveats. A short streak means a genuine fast move is followed quickly — correct for a band-capped desk, but the controller is not a shock absorber; the band + caps + pro-rata are what bound loss. And the N oracles must be genuinely independent — N feeds reading one upstream API is one oracle wearing N hats, and the median then proves nothing.

See DebitCredit/ROADMAP.md M5, ADR-0035 (bridge/oracle trust).

---

2. What the Uniform Fiat covenants consume

Input	Consumer	On-chain message	Signed by	Notes
Deposit price (stablecoin → currency, MARKET value)	UniformReserve.deposit	78-byte attestation: recipient(25)‖slot(1)‖amount(8)‖price(8)‖outpoint(36)	the currency's deposit oracle (oraclePk)	price is replay-bound to the controller outpoint (single-use); credits amount × price / priceScale
FX rate (currency pair)	UniformReserve.fxSwap	97-byte: usdOutpoint‖eurOutpoint‖dir(1)‖amtUsd(8)‖amtEur(8)‖rate(8)	the shared FX oracle (fxOraclePk)	binds both legs; both verify amtUsd × fxRateScale == amtEur × rate
BCH/USD price (fee sizing / FIATm)	DeviantOracleMBA, DeviantTieredMintOracleFT, AnyHedge	16-byte AnyHedge/Paryon format: timestamp(4)‖sequence(4)‖contentSequence(4)‖price(4) (uint32 LE)	a price oracle pubkey	the canonical BCH pure-price-feed shape — this is the oracles.cash / General Protocols format

The 16-byte General Protocols format is the reusable pure-price feed; our deposit/FX messages are bespoke attestations that embed the price and bind it to a specific spend (replay-safe). M5's freshness bound is where the 16-byte format's timestamp field gets enforced.

---

3. Primary reference — oracles.cash (General Protocols)

https://oracles.cash/ — the live Bitcoin Cash price-oracle network, run under the General Protocols oracle policy (same org behind AnyHedge). It is the production instantiation of the exact checkDataSig pattern Deviant already prototyped and chipnet-validated — not a new dependency, the same pattern proven live on mainnet.

• Model: each oracle = a public key + a published policy (pairs, cadence, source = "General Protocols Price Source"); emits signed price messages covenants verify with OP_CHECKDATASIG. Consumed in production (AnyHedge pulls settlement prices from these oracles).
• Message: the 16-byte format in §2 (timestamp‖sequence‖contentSequence‖price, uint32 LE) — identical to what DeviantOracleMBA already reads.
• Tooling / policy: templates github.com/Bitcoin-com/oracles.cash; policy generalprotocols.com/price-oracle-policy/. The site itself is a JS-rendered monitoring dashboard (a plain HTTP fetch returns only the title).
• Why it matters here: FIATm/BCHm + the Uniform Fiat FX rate can point at a GP oracle pubkey instead of running our own — the "who runs / why trust it" question is answered by the pubkey-identified, published policy. It shares infra with AnyHedge (Path C already depends on it).
• Open item: confirm whether GP runs a chipnet oracle pubkey (to wire covenants to a real feed on chipnet); otherwise model our deposit/FX oracle message on the GP policy and mirror its cadence.

Full diagnosis: memory oracles-cash-bch-oracle-network.

---

4. Reference table — oracle sources (BCH-native + source-chain + off-chain)

Ordered by fit for this project. "On-chain trust" = whether a BCH covenant can verify it directly.

BCH-native (directly checkDataSig-verifiable — the real fit)

Source	What	On-chain (BCH)	Use for
oracles.cash / General Protocols	production BCH price-oracle network, pubkey + policy, signed messages	✅ checkDataSig, 16-byte format	primary — FX rate, BCH/USD, deposit price (per pair GP covers)
AnyHedge oracles	the same GP oracle infra, consumed by AnyHedge settlement	✅ same format	FIATm/AnyHedge (Path C); shares the feed
Self-run GP-policy oracle	our own pubkey following the GP policy shape	✅	pairs GP doesn't cover (a specific stablecoin/currency); run one per admitted feed, disclose the pubkey

Cross-chain / source-chain (native to the deposit chain — off the BCH VM wall)

These live on the source chains where the stablecoins are locked; useful for the correspondent's off-chain pricing (what the desk signs into its BCH attestation), not directly BCH-verifiable.

Source	Chains	Model	Note
Chainlink	Ethereum + most EVM, Solana	push (aggregated feeds) + CCIP	the incumbent; deep stablecoin/USD + FX feeds; use to source the desk's off-chain price
Pyth Network	100+ chains (Solana-native, pull)	pull (signed prices, on-demand)	wide stablecoin + FX coverage; signed-message model is conceptually close to GP
RedStone	EVM, many	pull / modular	good long-tail + LST/stablecoin coverage
Chronicle	Ethereum	signed feeds (ex-MakerDAO oracles)	powers DAI/USDS; relevant when pricing CDP coins
API3 / DIA / Band / Switchboard / Supra / Tellor	various	first-party / dispute-based / Solana	alternates for chains/pairs the above miss

Off-chain aggregators (reference prices only — NOT on-chain trust)

For the desk's own market-value read (before it signs), and for the track-record files — never as an on-chain source of truth.

Source	Use
CoinGecko / CoinPaprika	reference market prices + which chains carry a stablecoin (already used by D:\Dev\CoinSpectrum)
DefiLlama	stablecoin supply + per-chain breakdown (for the track records + caps)
CashToken Markets (cashtokenmarkets.bch-1.org)	BCH-native token prices (MUSD; PUSD via Cauldron/Rostrum) — see CoinSpectrum providers/cashtokens.mjs

---

5. Recommendations for Uniform Fiat

1. Anchor on General Protocols / oracles.cash for the BCH-side feeds (FX rate + BCH/USD), reusing the 16-byte format the covenants already parse. One pubkey per feed, policy published.
2. Per-stablecoin deposit price: for each admitted (issuer × chain) cell, source the market price off-chain (Chainlink/Pyth on the source chain + a CoinGecko cross-check), have the correspondent deposit oracle sign it into the 78-byte attestation. Disclose the rate at deposit ("USDC is trading at $0.87 — you will receive 0.87 USD").
3. M5 hardening — shipped: the 2-of-3 quorum (three independent oracle pubkeys per instance; the desk aggregates/medians off-chain, the quorum ratifies on-chain), the outpoint-bound staleness window, the maxPrice ceiling + overflow guard. Configure the same three FX keys on both paired instances. Still open: layering the FIATm §12 signaling controller (multi-block confirmation) on the rate feed. A true on-chain median of three distinct signed prices (three messages, three sigs) is the heavier variant, deferred — quorum-over-an-aggregate delivers the "no single oracle moves the reserve" property at a fraction of the script cost.
4. Never let the oracle be the authority — keep the caps + band + pro-rata + pause as the real guards, so even a fully-compromised feed's blast radius stays bounded (constraint: fiatm-oracle-as-signaling-machine).

---

Links

• Primary source: oracles.cash · policy generalprotocols.com/price-oracle-policy/ · templates github.com/Bitcoin-com/oracles.cash
• Consumers: contracts/UniformReserve.cash (deposit/fxSwap), DeviantOracleMBA.cash, DeviantTieredMintOracleFT · AnyHedge (Path C)
• Design: UniformFiat/architecture.md §oracle · plan DebitCredit/ROADMAP.md M5 · ADR-0035 (bridge/oracle trust), ADR-0051
• Memories: oracles-cash-bch-oracle-network, fiatm-oracle-as-signaling-machine, cashscript-covenant-findings, path-c-anyhedge-paryon-dusd