Multi-Oracle Aggregation

One key can sign a wrong or stolen price. Then each contract that reads that slot key gets this fixing. More signers remove this single point of failure. The sources implement a quorum of signers in the oracle output and a median in consumer contracts, but they do not implement a median in the output or the eviction of a signer. Status lists each feature.

Quorum on one sample

AttestationBeacon takes 1 to 5 signer keys and a threshold. attest counts the valid signatures over one message. The message is the SHA-256 hash of the asset id, the ticker, the price, and the time. The spend fails when fewer than threshold signatures are valid (the loop). The first signersN keys must be different from each other.

Setup	To forge a price	To publish a price
1 of 1	You need the key.	You need the key.
3 of 5	You need 3 keys.	You need 3 signers that are online and sign the same sample.

All signers sign the same price and the same time. A signature counts only for the sample that it signs. Signers that report different prices do not reach a quorum. The contract counts agreement, and it does not combine prices. The quotes become one sample offchain, before the signers sign. The desk of arkade-options sets the price of its quotes with the median of Coinbase, Kraken, and Binance. The desk needs two live venues. The oracle service samples one source, the Deribit BTCUSD index. For a signer that did not sign, pass an empty signature. attest checks each slot below signersN. A valid signature counts 1. An empty signature counts 0. Any other signature fails the transaction, also a signature of 64 zero bytes (opcodeChecksigFromStack). The arkade-prediction repository passes an empty signature for each absent signer. A quorum does not give independence. The open-source oracle service takes all signer keys as secrets in one process and tests the quorum script, but it does not give independent custody or independent data.

Median of signed prices

A median needs each signer’s own price, so one agreed price is not enough. In the sources, the consumer computes the median with Arkade opcodes. The options example in the compiler verifies three signatures from three different oracles for each print. It takes the median of the three prices:

examples/option/option_vault.ark @ f9f8866

  private function median3(int a, int b, int c) int {
    if (a <= b && b <= c) { return b; }
    if (a <= c && c <= b) { return c; }
    if (b <= a && a <= c) { return a; }
    if (b <= c && c <= a) { return c; }
    if (c <= a && a <= b) { return a; }
    return b;
  }

  private function max3(int a, int b, int c) int {
    if (a >= b && a >= c) { return a; }
    if (b >= a && b >= c) { return b; }
    return c;
  }

  private function min3(int a, int b, int c) int {
    if (a <= b && a <= c) { return a; }
    if (b <= a && b <= c) { return b; }
    return c;
  }

  private function attest(int price, int time, int index, signature sig) {
    require(price > 0, "nonpositive price");
    require(price <= PRICE_MAX, "price cap");
    require(time > 0, "nonpositive time");
    let ticker = 0x425443555344;
    let msg = sha256(ticker + num2bin(price, 8) + num2bin(time, 8));
    require(checkSigFromStack(sig, oracles[index], msg), "bad oracle sig");
  }

settle then checks that the three signers of a print are different. It verifies each signature and takes the median:

examples/option/option_vault.ark @ f9f8866

    require(who0[0] != who0[1], "same oracle");
    require(who0[0] != who0[2], "same oracle");
    require(who0[1] != who0[2], "same oracle");
    require(who1[0] != who1[1], "same oracle");
    require(who1[0] != who1[2], "same oracle");
    require(who1[1] != who1[2], "same oracle");
    require(who2[0] != who2[1], "same oracle");
    require(who2[0] != who2[2], "same oracle");
    require(who2[1] != who2[2], "same oracle");

    for (i, px) in price0 {
      attest(px, time0[i], who0[i], sig0[i]);
    }
    for (i, px) in price1 {
      attest(px, time1[i], who1[i], sig1[i]);
    }
    for (i, px) in price2 {
      attest(px, time2[i], who2[i], sig2[i]);
    }

    int m0 = median3(price0[0], price0[1], price0[2]);
    int m1 = median3(price1[0], price1[1], price1[2]);
    int m2 = median3(price2[0], price2[1], price2[2]);
    slice(time0[0], time0[1], time0[2], expiry - 1800, expiry - 1740);
    slice(time1[0], time1[1], time1[2], expiry - 960, expiry - 900);
    slice(time2[0], time2[1], time2[2], expiry, expiry + 60);

With 2f + 1 signers, up to f signers can report any price. The median stays between the lowest and the highest honest price. With three signers, one wrong price cannot move the result outside the two honest prices. For a yes-or-no question against a fixed strike, the contract does not sort. PriceVault in the prediction market counts the signers whose signed value is on one side of the strike. With five signers and quorum 3, this gives the median. The quorum must be a majority of the signers. With a smaller quorum, both sides can reach the quorum.

contracts/src/price_vault.ark @ c0b063f

  private function side(bytes32[5] values, bytes[5] stamps, signature[5] sigs, bool above) {
    // Below a majority of the 5 slots both sides could reach the quorum.
    require(quorum * 2 > 5, "majority");
    bytes tail = reverseBytes(num2bin(32, 4)) + reverseBytes(num2bin(1, 3));
    bytes m0 = digest(feedId + values[0] + stamps[0] + tail, 4);
    int c0 = 0;
    if (checkSigFromStack(sigs[0], signers[0], m0) && size(stamps[0]) == 6 && substr(values[0], 0, 24) == num2bin(0, 24) && bin2num(reverseBytes(stamps[0])) == settleAtMs && (bin2num(reverseBytes(substr(values[0], 24, 8))) >= strike) == above) {
      c0 = 1;
    }
    bytes m1 = digest(feedId + values[1] + stamps[1] + tail, 4);
    int c1 = 0;
    if (checkSigFromStack(sigs[1], signers[1], m1) && size(stamps[1]) == 6 && substr(values[1], 0, 24) == num2bin(0, 24) && bin2num(reverseBytes(stamps[1])) == settleAtMs && (bin2num(reverseBytes(substr(values[1], 24, 8))) >= strike) == above) {
      c1 = 1;
    }
    bytes m2 = digest(feedId + values[2] + stamps[2] + tail, 4);
    int c2 = 0;
    if (checkSigFromStack(sigs[2], signers[2], m2) && size(stamps[2]) == 6 && substr(values[2], 0, 24) == num2bin(0, 24) && bin2num(reverseBytes(stamps[2])) == settleAtMs && (bin2num(reverseBytes(substr(values[2], 24, 8))) >= strike) == above) {
      c2 = 1;
    }
    bytes m3 = digest(feedId + values[3] + stamps[3] + tail, 4);
    int c3 = 0;
    if (checkSigFromStack(sigs[3], signers[3], m3) && size(stamps[3]) == 6 && substr(values[3], 0, 24) == num2bin(0, 24) && bin2num(reverseBytes(stamps[3])) == settleAtMs && (bin2num(reverseBytes(substr(values[3], 24, 8))) >= strike) == above) {
      c3 = 1;
    }
    bytes m4 = digest(feedId + values[4] + stamps[4] + tail, 4);
    int c4 = 0;
    if (checkSigFromStack(sigs[4], signers[4], m4) && size(stamps[4]) == 6 && substr(values[4], 0, 24) == num2bin(0, 24) && bin2num(reverseBytes(stamps[4])) == settleAtMs && (bin2num(reverseBytes(substr(values[4], 24, 8))) >= strike) == above) {
      c4 = 1;
    }
    require(c0 + c1 + c2 + c3 + c4 >= quorum, "quorum");
  }

Both contracts store the signer keys in their constructor. This is the dependency that The Coupling Problem describes. When a key changes, each open consumer stays with the old committee.

Outliers and eviction

A median tolerates an outlier, but it does not remove the signer that reported the outlier. No contract in the sources evicts a signer for a deviation. The script of the output stores the committee as constructor arguments. To change the committee, the admin runs migrate to a script with a different signers set. The asset id does not change, so no consumer changes.

Status

Feature	Status	Source
Quorum of signers on one sample, 1 to 5 keys	Implemented	`attestation_beacon.ark`
Median of each signer’s own price, in the consumer	Implemented in two consumer contracts	`examples/option` in the compiler, `PriceVault` in the prediction market
Median in the oracle output	Not implemented	None
Eviction of a signer that deviates	Not implemented	None
Replacement of the signers	`migrate` by `adminPk`. `arkade-options` has no builder and no test for it.	`attestation_beacon.ark`

Source files: examples/option/option_vault.ark at f9f8866, contracts/src/price_vault.ark at c0b063f, and attestation_beacon.ark at 9fc10ef.

Understand

Reference

Quorum on one sample

Median of signed prices

Outliers and eviction

Status

​Quorum on one sample

​Median of signed prices

​Outliers and eviction

​Status

Quorum on one sample

Median of signed prices

Outliers and eviction

Status