Oracle Output

AttestationBeacon is the oracle output contract. Copy it below. Asset as Contract ID explains the asset. A sample is a price and a time that the signers sign. A fixing is the price that the output stores in a slot. The slot key names the slot. The binding on this page uses one key. Multi-Oracle Aggregation is the same contract with more signers, and the consumers that take a median.

Source

Copy the contract without changes. A change to the code changes the address of the output. Compile the file with arkadec (Compiler). Constructor lists the arguments that you bind.

contracts/attestation_beacon.ark @ 9fc10ef

pragma arkade ^0.1.0;

// AttestationBeacon: a price registry that other covenants read by spending
// it in the same transaction.
//
// One to five oracle keys sign each sample. `signersN` is how many of the five
// slots are real, and `threshold` is how many of those must sign (at least 1).
// A sample is
// sha256(ctrlTxid || 0x425443555344 || num2bin(price, 8) || num2bin(time, 8)).
// Anyone who has those signatures can write the slot. The aggregator does that
// in one transaction. Reading the coin still adds readFee, paid by the vault.
// The sample time must be at or before key + keyLag. The clock must have
// reached key + keyLag, so a fixing cannot land before its close.
// adminPk migrates the coin and takes the unilateral exit. It does not sign prices.
//
// State is the extension packet of type STATE, 329 bytes:
//   0        version, 0x01
//   1..9     round, num2bin(round, 8)
//   9..329   8 slots of 40 bytes, newest first: key num2bin(key, 8), value 32 bytes
// The value is num2bin(price, 32). The vault reads the first 8 bytes.
//
// `read` adds readFee sats to output 0. The vault being settled pays that fee
// out of its locked collateral. There is no third input.

contract AttestationBeacon(
  bytes32 ctrlTxid,
  int ctrlGidx,
  pubkey[5] signers,
  int signersN,
  int threshold,
  bytes domain,
  int keyLag,
  int readFee,
  pubkey adminPk,
  int exit
) {
  const int STATE = 32;
  const int SIZE = 329;
  const int SLOTS = 9;
  const int VALUE_AT = 17;
  const int HISTORY_AT = 49;
  const int HISTORY = 280;
  const int PRICE_MAX = 1000000000;

  private function committee() {
    require(signersN >= 1, "signers");
    require(signersN <= 5, "signers");
    require(threshold >= 1, "threshold");
    require(threshold <= signersN, "threshold");
    if (signersN > 1) {
      require(signers[0] != signers[1], "duplicate signer");
    }
    if (signersN > 2) {
      require(signers[0] != signers[2], "duplicate signer");
      require(signers[1] != signers[2], "duplicate signer");
    }
    if (signersN > 3) {
      require(signers[0] != signers[3], "duplicate signer");
      require(signers[1] != signers[3], "duplicate signer");
      require(signers[2] != signers[3], "duplicate signer");
    }
    if (signersN > 4) {
      require(signers[0] != signers[4], "duplicate signer");
      require(signers[1] != signers[4], "duplicate signer");
      require(signers[2] != signers[4], "duplicate signer");
      require(signers[3] != signers[4], "duplicate signer");
    }
  }

  private function continues(bytes state) {
    require(size(state) == SIZE, "state size");
    require(substr(state, 0, 1) == 0x01, "state version");
    require(tx.outputs[0].scriptPubKey == tx.input.current.scriptPubKey, "script");
    require(tx.outputs[0].assets.lookup(ctrlTxid, ctrlGidx) == 1, "identity asset");
  }

  private function absent(bytes prev, int key) {
    int[8] slots = [9, 49, 89, 129, 169, 209, 249, 289];
    for (i, offset) in slots {
      require(substr(prev, offset, 8) != num2bin(key, 8), "key already in a slot");
    }
  }

  function attest(int key, int price, int time, signature[5] sigs) {
    require(this.activeInputIndex == 0, "beacon is input 0");
    require(key > 1800, "key");
    if (keyLag >= 0) {
      require(checkTime(key + keyLag), "before key time");
    }
    require(price > 0, "nonpositive price");
    require(price <= PRICE_MAX, "price cap");
    require(time > 0, "nonpositive time");
    require(time <= key + keyLag, "sample after close");
    committee();
    let ticker = 0x425443555344;
    let msg = sha256(ctrlTxid + ticker + num2bin(price, 8) + num2bin(time, 8));
    int valid = 0;
    for (i, sig) in sigs {
      if (i < signersN) {
        if (checkSigFromStack(sig, signers[i], msg)) {
          valid = valid + 1;
        }
      }
    }
    require(valid >= threshold, "quorum");

    bytes prev = tx.inputs[0].packet(STATE);
    bytes next = tx.packet(STATE);
    require(size(prev) == SIZE, "prev size");
    require(size(next) == SIZE, "next size");
    require(substr(prev, 0, 1) == 0x01, "prev version");
    require(substr(next, 0, 1) == 0x01, "next version");
    absent(prev, key);
    require(bin2num(substr(next, 1, 8)) == bin2num(substr(prev, 1, 8)) + 1, "round");
    require(substr(next, SLOTS, 8) == num2bin(key, 8), "slot key");
    require(substr(next, VALUE_AT, 32) == num2bin(price, 32), "slot value");
    require(substr(next, HISTORY_AT, HISTORY) == substr(prev, SLOTS, HISTORY), "history");
    require(tx.outputs[0].value >= tx.input.current.value, "value");
    continues(next);
  }

  function read(int selfIndex) {
    require(selfIndex == this.activeInputIndex, "self index");
    bytes state = tx.packet(STATE);
    require(state == tx.inputs[selfIndex].packet(STATE), "state carried");
    require(tx.outputs[0].value >= tx.input.current.value + readFee, "read fee");
    continues(state);
  }

  function migrate(bytes32 next, signature opSig) {
    require(this.activeInputIndex == 0, "beacon is input 0");
    bytes state = tx.packet(STATE);
    require(state == tx.inputs[0].packet(STATE), "state carried");
    require(size(state) == SIZE, "state size");
    int round = bin2num(substr(state, 1, 8));
    let msg = sha256(domain + "migrate" + ctrlTxid + num2bin(ctrlGidx, 4) + num2bin(round, 8) + next);
    require(checkSigFromStack(opSig, adminPk, msg), "oracle service");
    require(tx.outputs[0].scriptPubKey == next, "next script");
    require(tx.outputs[0].value >= tx.input.current.value, "value");
    require(tx.outputs[0].assets.lookup(ctrlTxid, ctrlGidx) == 1, "identity asset");
  }

  function unilateral(signature adminSig) tapscript {
    require(older(exit));
    require(checkSig(adminSig, adminPk));
  }
}

arkadec attestation_beacon.ark -o attestation_beacon.json

The file is attestation_beacon.ark in arkade-options 9fc10ef.

Constructor

Parameter	Role
`ctrlTxid`, `ctrlGidx`	The identity asset. One unit stays on output 0 of each cooperative spend. `ctrlTxid` is the issuance txid in reverse of its display order.
`signers`, `signersN`, `threshold`	`signers` has five slots. The first `signersN` slots (1 to 5) are real and different from each other. `threshold` of them (1 to `signersN`) must sign a sample.
`domain`	Bytes in the `migrate` digest. The deployed oracle uses `BTCUSD-FIX`.
`keyLag`	The time of a sample must not be later than the slot key plus `keyLag`. If `keyLag` is 0 or more, the emulator clock must also reach the slot key plus `keyLag`. A negative value skips the clock check. The deployed oracle uses 60.
`readFee`	The sats that `read` adds to output 0. The deployed oracle uses 1000.
`adminPk`	Signs `migrate`. Owns `unilateral`. Does not sign prices.
`exit`	The BIP68 sequence of the `unilateral` leaf.

The ticker is not a parameter. The contract fixes it as BTCUSD (0x425443555344).

Binding

The SDK flattens arrays. The constructor arguments are signers.0 to signers.4. The call arguments are sigs.0 to sigs.4. The artifact also declares server. The SDK client binds server to the operator key.

State packet

The packet has type 32 and 329 bytes. Integers use num2bin: little-endian sign-magnitude.

Offset	Size	Field
0	1	Version `0x01`
1	8	Round
9	320	Eight slots of 40 bytes, newest first. Each slot has an 8-byte key and a 32-byte value.

The genesis state is round 0 with eight zero slots. attest stores the price in the value as a 32-byte number. A consumer reads the first 8 bytes of the value to get the price.

Functions

attest spends the output at input 0. The sample digest is the SHA-256 hash of the asset id, the ticker, the price (8 bytes), and the time (8 bytes). Slot i of sigs belongs to signer i. A slot below signersN holds a valid signature or an empty signature. Any other value fails the spend. The spend needs at least threshold valid signatures. The next packet has the round plus 1. Slot 0 holds the slot key and the price. Slots 1 to 7 hold the old slots 0 to 6. The slot key must not be in a current slot. read keeps the packet of the output the same. It checks that output 0 gains readFee. It has no signature check. Output 0 carries the oracle output’s own script, because it is the oracle’s continuation. A contract that also continues on output 0, like the pool templates (Lending, Automated Market Maker), cannot spend in the same transaction as a read: one output 0 cannot carry two scripts. A vault that settles without continuing can share the transaction and pays readFee from its locked funds. Any other reader spends the oracle in a separate transaction. migrate spends the output at input 0. adminPk signs the SHA-256 hash of the domain, the text migrate, the asset id, the group index (4 bytes), the round (8 bytes), and next. The round comes from the current packet. Output 0 pays the 32-byte program next with the unit and the same packet. unilateral is the exit if the operator is unavailable. It is a tapscript leaf that needs the CSV exit and a signature from adminPk. The emulator runs each function except unilateral.

Set up one key

One key means one signer (signersN), a threshold of 1, and an admin key (adminPk) that equals the signer key. The contract checks only the first signersN signer slots. Repeat the signer key in the other four slots. Build exit as a BIP68 sequence (CSV sequences). Use the issuance txid in reverse byte order for ctrlTxid (Asset as Contract ID).

oracle.ts

import fs from "node:fs";
import { Arkade, arkade, asset, SingleKey, timelockToSequence } from "@arkade-os/sdk";

const admin = SingleKey.fromHex(process.env.ORACLE_KEY_HEX!);
const adminPk = await admin.xOnlyPublicKey();
const id = asset.AssetId.fromString(process.env.ORACLE_ASSET_ID!);

const client = await Arkade.connect({ service: { network: "bitcoin" }, identity: admin });
const delay = (await client.arkProvider.getInfo()).unilateralExitDelay;
const exit = timelockToSequence({ type: delay >= 512n ? "seconds" : "blocks", value: delay });
const program = arkade.programFromArtifact(JSON.parse(fs.readFileSync("attestation_beacon.json", "utf8")));

function oracle(signer: Uint8Array) {
  return client.contract(program, {
    ctrlTxid: Uint8Array.from(id.txid).reverse(),
    ctrlGidx: BigInt(id.groupIndex),
    signersN: 1n,
    threshold: 1n,
    "signers.0": signer,
    "signers.1": signer,
    "signers.2": signer,
    "signers.3": signer,
    "signers.4": signer,
    domain: new TextEncoder().encode("BTCUSD-FIX"),
    keyLag: 60n,
    readFee: 1000n,
    adminPk,
    exit: BigInt(exit),
  });
}

const current = oracle(adminPk);
console.log(current.address);

To deploy, spend the issued output. Output 0 pays to current. It holds the unit and a genesis state packet (round 0, eight zero slots). The function genesisOutputs in protocol/beacon.ts builds the outputs. The wallet submits them as an offchain transaction. The deployed oracle uses keyLag 60. The emulator clock must be 60 seconds past the slot key before attest writes it. A negative keyLag removes that clock gate: attest then checks only that the sample time is not later than the slot key plus keyLag, so a fixing can land at any time. Deploy a negative lag only when the signers’ own process is the liveness guarantee, because the emulator no longer stops an early fixing. The deployed oracle uses readFee 1000, which is more than the dust limit of 330 sats.

The output

Each cooperative spend creates the output again on output 0 with its identity unit. Only migrate changes the script.

Publish a price

Anyone who has the signatures of the quorum can write a sample into the output. With one key, the quorum is one signature. The output is the only input. It returns on output 0 with the new state:

in 0  oracle output  (attest)     out 0  oracle output: same script, at least the same sats, 1 identity unit
                                out 1  extension: asset packet (unit 0 -> 0), state packet, emulator packet
                                out 2  anchor

The signer signs a digest that contains the asset of the oracle. num2bin writes a number as little-endian sign-magnitude bytes. The top bit of the last byte must stay clear.

protocol/beacon.ts @ 9fc10ef

/** `num2bin(value, size)`: little-endian sign-magnitude, so the top bit must stay clear. */
export function num2bin(value: bigint, size: number): Uint8Array {
  if (value < 0n) throw new Error("num2bin: negative");
  if (value >= 1n << BigInt(size * 8 - 1)) throw new Error(`num2bin: ${value} does not fit ${size} bytes`);
  const out = new Uint8Array(size);
  let rest = value;
  for (let i = 0; i < size; i++) {
    out[i] = Number(rest & 0xffn);
    rest >>= 8n;
  }
  return out;
}
// ...
const TICKER = new Uint8Array([0x42, 0x54, 0x43, 0x55, 0x53, 0x44]);

/** Sample the beacon checks: `sha256(ctrlTxid || BTCUSD || price_le64 || time_le64)`. */
export function sampleDigest(ctrlTxid: Uint8Array, price: bigint, time: bigint): Uint8Array {
  if (ctrlTxid.length !== 32) throw new Error("ctrlTxid must be 32 bytes");
  return sha256(ctrlTxid, TICKER, num2bin(price, 8), num2bin(time, 8));
}

The signer signs the digest with a BIP340 Schnorr signature:

const signature = await signer.signMessage(sampleDigest(ctrlTxid, price, time), "schnorr");

The contract checks only that the slot key is greater than 1800. The consumer decides what the slot key means. OptionVault uses its expiry time in unix seconds. attest verifies the signature, the clock, and the change of state. The excerpt omits the check of the signer set and the checks of the packet size and version:

contracts/attestation_beacon.ark @ 9fc10ef

  function attest(int key, int price, int time, signature[5] sigs) {
    require(this.activeInputIndex == 0, "beacon is input 0");
    require(key > 1800, "key");
    if (keyLag >= 0) {
      require(checkTime(key + keyLag), "before key time");
    }
    require(price > 0, "nonpositive price");
    require(price <= PRICE_MAX, "price cap");
    require(time > 0, "nonpositive time");
    require(time <= key + keyLag, "sample after close");
    // ...
    let ticker = 0x425443555344;
    let msg = sha256(ctrlTxid + ticker + num2bin(price, 8) + num2bin(time, 8));
    int valid = 0;
    for (i, sig) in sigs {
      if (i < signersN) {
        if (checkSigFromStack(sig, signers[i], msg)) {
          valid = valid + 1;
        }
      }
    }
    require(valid >= threshold, "quorum");

    bytes prev = tx.inputs[0].packet(STATE);
    bytes next = tx.packet(STATE);
    // ...
    absent(prev, key);
    require(bin2num(substr(next, 1, 8)) == bin2num(substr(prev, 1, 8)) + 1, "round");
    require(substr(next, SLOTS, 8) == num2bin(key, 8), "slot key");
    require(substr(next, VALUE_AT, 32) == num2bin(price, 32), "slot value");
    require(substr(next, HISTORY_AT, HISTORY) == substr(prev, SLOTS, HISTORY), "history");
    require(tx.outputs[0].value >= tx.input.current.value, "value");
    continues(next);
  }

With one signer, the loop verifies the first signature against the first signer key. It ignores the other four slots.

Rule	Result
At least `threshold` signatures over the sample digest are valid.	Only the quorum can write. The digest contains the asset id, so nobody can replay a signature on another oracle.
The emulator clock has reached the slot key plus `keyLag`. The sample time is not later than that sum.	A fixing cannot arrive before its close. A sample cannot come from after the close.
The slot key is in no slot.	The output does not write a slot key again when the key is in a slot.
The round increases by 1. Slot 0 holds the new fixing. Slots 1 to 7 hold the old slots 0 to 6.	History only shifts. Nobody can rewrite it or skip a round.
Output 0 has the same script, at least the input value, and one identity unit.	The output stays an oracle.

The contract limits time from above only, and the slot does not store time. See Limits. The function buildAttest builds the transaction that oracle/service.ts sends:

protocol/cospend.ts @ 9fc10ef

export function buildAttest(input: {
  beacon: BeaconCoin;
  key: bigint;
  price: bigint;
  time: bigint;
  /** Five slots. Only the first `signersN` are checked. The rest can be zeros. */
  sigs: readonly Uint8Array[];
  next: Uint8Array;
  checkpoint: CSVMultisigTapscript.Type;
}): Built {
  // ...
  return build(
    [{
      script: input.beacon.script,
      fn: "attest",
      callArgs,
      coin: input.beacon.coin,
    }],
    [{ script: input.beacon.script.pkScript, amount: BigInt(input.beacon.coin.value) }],
    [unitTransfer(input.beacon.id, 0, 0), statePacket(input.next)],
    input.checkpoint,
  );
}

Consume the price

A consumer spends the oracle output as an input of its own transaction. read has no signature check, so anyone can build this transaction. In OptionVault, the consumer is input 0 and the oracle output is input 1. read takes the index of its own input. The payouts come from the output of the consumer, minus readFee:

in 0  consumer output  (settle)               out 0   oracle output: same script, same state, value + readFee, 1 identity unit
in 1  oracle output    (read, selfIndex 1)    out 1…  payouts from the consumer's sats minus readFee
                                            out n+1 extension: asset packet (unit 1 -> 0), state packet copy, emulator packet (one entry per covenant input)
                                            out n+2 anchor

read keeps the state and charges the fee:

contracts/attestation_beacon.ark @ 9fc10ef

  function read(int selfIndex) {
    require(selfIndex == this.activeInputIndex, "self index");
    bytes state = tx.packet(STATE);
    require(state == tx.inputs[selfIndex].packet(STATE), "state carried");
    require(tx.outputs[0].value >= tx.input.current.value + readFee, "read fee");
    continues(state);
  }

The consumer finds the oracle with the asset id. It reads the state packet of input 1. It takes the price from the slot whose key is its expiry:

contracts/option_vault.ark @ 9fc10ef

    require(this.activeInputIndex == 0, "vault is input 0");
    require(tx.numInputs >= 2, "vault and beacon");
    require(tx.inputs[1].assets.lookup(beaconTxid, beaconGidx) == 1, "beacon");

    bytes state = tx.inputs[1].packet(STATE);
    require(size(state) == SIZE, "state size");
    require(substr(state, 0, 1) == 0x01, "state version");

    int st = 0;
    int found = 0;
    int[8] slots = [9, 49, 89, 129, 169, 209, 249, 289];
    for (i, offset) in slots {
      if (found == 0 && substr(state, offset, 8) == num2bin(expiry, 8)) {
        st = bin2num(substr(state, (offset + 8), 8));
        found = 1;
      }
    }
    require(found == 1, "no fixing for expiry");
    require(st > 0, "price");
    require(st <= PRICE_MAX, "price cap");

Rule	Result
`read`: the state packet of the transaction equals the state packet of the output	A spender cannot replace the price.
`read`: output 0 pays at least the input value plus `readFee`	Each read costs `readFee`. The consumer pays it.
Consumer: one unit of its stored id on input 1	A different output cannot act as the oracle.
Consumer: a slot that has its `expiry` as slot key, and a price in range	Settlement needs a published fixing for its slot key.
Emulator: the previous transaction that the spender attaches must hash to the transaction that the checkpoint of the input spends	The emulator rejects a forged previous transaction, and so a forged packet (`prevout tx hash mismatch` in the emulator source at `bd17836`).

The function buildSettle builds the settlement transaction. The builder of the SDK spends one covenant output. cospend.ts assembles two:

protocol/cospend.ts @ 9fc10ef

export function buildSettle(input: {
  vault: { script: arkade.ArkadeProgramScript; coin: Coin };
  beacon: BeaconCoin;
  readFee: bigint;
  payouts: { script: Uint8Array; amount: bigint }[];
  checkpoint: CSVMultisigTapscript.Type;
}): Built {
  const spends: Spend[] = [
    { script: input.vault.script, fn: "settle", coin: input.vault.coin },
    { script: input.beacon.script, fn: "read", callArgs: { selfIndex: 1n }, coin: input.beacon.coin },
  ];
  const outputs = [
    { script: input.beacon.script.pkScript, amount: BigInt(input.beacon.coin.value) + input.readFee },
    ...input.payouts,
  ];
  return build(spends, outputs, [unitTransfer(input.beacon.id, 1, 0), statePacket(input.beacon.state)], input.checkpoint);
}

Replace the key

The admin replaces the script of the output, for example with a script that has a new signer key. The contracts that read the output do not change, because they look for the same asset id.

in 0  oracle output  (migrate)    out 0  oracle output: new script, at least the same sats, 1 identity unit
                                out 1  extension: asset packet (unit 0 -> 0), state packet unchanged, emulator packet
                                out 2  anchor

migrate takes the 32-byte program of the new script and a signature from adminPk:

contracts/attestation_beacon.ark @ 9fc10ef

  function migrate(bytes32 next, signature opSig) {
    require(this.activeInputIndex == 0, "beacon is input 0");
    bytes state = tx.packet(STATE);
    require(state == tx.inputs[0].packet(STATE), "state carried");
    require(size(state) == SIZE, "state size");
    int round = bin2num(substr(state, 1, 8));
    let msg = sha256(domain + "migrate" + ctrlTxid + num2bin(ctrlGidx, 4) + num2bin(round, 8) + next);
    require(checkSigFromStack(opSig, adminPk, msg), "oracle service");
    require(tx.outputs[0].scriptPubKey == next, "next script");
    require(tx.outputs[0].value >= tx.input.current.value, "value");
    require(tx.outputs[0].assets.lookup(ctrlTxid, ctrlGidx) == 1, "identity asset");
  }

To replace the signer key, do these steps:

Bind the new script with the same arguments and the new key in signers. The 32-byte program of this script is next.
Read round from bytes 1 to 8 of the state packet of the output.
Compute the digest msg as the function migrate computes it. Sign the digest with the key of adminPk. The signature is opSig.
Spend the output at input 0 with the function migrate. Pass next and opSig.
Pay output 0 to the new script with the unit and at least the input value. Keep the state packet the same.

const newSigner = SingleKey.fromHex(process.env.NEW_SIGNER_KEY_HEX!);
const next = oracle(await newSigner.xOnlyPublicKey()).vtxoScript.tweakedPublicKey;

Rule	Result
`adminPk` signs the digest	Only the admin can replace the script.
The digest contains `round`	A signature is good for one state. Nobody can replay it after the next `attest`.
The state packet stays the same	A migration does not rewrite prices. The new script controls later writes.
Output 0 pays `next` with the unit	The unit moves only to the script that the admin signed.

arkade-options has no builder for migrate and no test that spends it. Steps 2 to 5 follow the contract. Use buildAttest as a template for the transaction.

Exit

contracts/attestation_beacon.ark @ 9fc10ef

  function unilateral(signature adminSig) tapscript {
    require(older(exit));
    require(checkSig(adminSig, adminPk));
  }

If the operator is unavailable, adminPk alone can claim the output onchain: unroll it, wait for the exit delay, and sign. The unit then leaves Arkade, and contracts that read this oracle can no longer settle against it.

Limits

Limit	Result
The contract limits `time` from above only. The slot does not store `time`.	The first submitter chooses the signed sample for a slot key. The output accepts a sample that is older than the slot key. The reference service prefers a sample from the window between the slot key and the slot key plus `keyLag`. The contract does not check this. A consumer cannot read the time of a signature.
The output has eight slots, newest first.	The eighth newer fixing pushes a slot key out. Anyone who has the original signatures can write that slot key again.
The output is one outpoint.	Reads happen one at a time. Concurrent consumers compete for the output. The loser builds the transaction again on the new outpoint. Each read adds one transaction to the offchain ancestry of the output. The sources do not measure the length of the exit chain after many reads.
`adminPk`	The admin can replace the script with any script (`migrate`). The admin can exit the output after the CSV (`unilateral`). The sources do not verify that the unit can enter Arkade again after an exit.
The ticker	The contract fixes the ticker as `BTCUSD`. One contract serves one pair.

Source files at 9fc10ef: attestation_beacon.ark, option_vault.ark, protocol/beacon.ts, protocol/cospend.ts, and the reference service oracle/service.ts.

Understand

Reference

Source

Constructor

Binding

State packet

Functions

Set up one key

The output

Publish a price

Consume the price

Replace the key

Exit

Limits

​Source

​Constructor

​Binding

​State packet

​Functions

​Set up one key

​The output

​Publish a price

​Consume the price

​Replace the key

​Exit

​Limits

Source

Constructor

Binding

State packet

Functions

Set up one key

The output

Publish a price

Consume the price

Replace the key

Exit

Limits