Skip to main content
Price-Transaction Atomicity (PTA) is the second of Intention’s four protocol-native guarantees. It eliminates, by construction, the oracle failure modes that are endemic to oracle-as-contract designs.

​
Definition

Let BB be a committed block containing a price quorum Q(B)=(pˉ,σ)Q(B) = (\bar{p}, \sigma), where pˉ\bar{p} is the canonical price vector and σ\sigma is a 2f+12f+1 stake-weighted aggregate signature over (pˉ,round(B),epoch(B))(\bar{p}, \text{round}(B), \text{epoch}(B)). For any transaction t∈Bt \in B that consults a price during execution — mark price, liquidation trigger price, funding-rate reference — the price read by tt is exactly pˉ\bar{p}. There is no execution path that reads a price other than pˉ\bar{p}. There is no path through which pˉ\bar{p} can be read outside the signature envelope of BB. The same 2f+12f+1 signatures that commit the transaction also commit the price it used.

​
Why it matters

PTA eliminates three classes of oracle failure that recur in oracle-as-contract designs on general-purpose chains:
  • Oracle race. A separate oracle committee operates on a different cycle from execution, and there is a timing competition between them. Under PTA there is no separate oracle committee — the validator set is the oracle.
  • Stale-price window. A price is pushed on-chain at time t1t_1 and the transaction that consumes it lands at t2>t1t_2 > t_1. Under PTA, price and transaction are committed in the same consensus round.
  • Oracle / execution divergence. Different prices are visible on different paths — one visible to a liquidation contract, another to a matching contract. Under PTA there is exactly one certified price vector per block, and all paths that read a price read the same one.
These are not engineering bugs introduced by sloppy implementations. They are structural consequences of keeping price and execution on separate cycles. PTA removes the separation.

​
How Intention enforces it

PTA is the joint property of two mechanisms from IntentionBFT: the in-consensus price quorum and the block structure that embeds it. In-consensus price quorum. Each validator runs a price observation pipeline that collects market data from a set of approved external venues and produces signed observations. Observations are aggregated via a stake-weighted median with MAD-based outlier rejection (see Oracle for the details). A block leader combines the aggregate with a signature over the contributing observations to form a price quorum certificate. Block structure. The price quorum is embedded in the block proposal so it is covered by the block hash — and therefore by the 2f+12f+1 signatures that commit the block. When validators verify a proposal in the prepare phase, they verify that the aggregate signature is valid, that the combined stake of contributors strictly exceeds 2S/32S/3, that the aggregate is the correct output of the aggregation rule applied to the contained observations, that the observations are within a protocol-defined staleness bound, and that the leader’s own observations are consistent with the aggregate within MAD bounds — a sanity check that prevents a faulty leader from fabricating contributions. If any check fails, the validator withholds its vote, the quorum is not collected, and the pacemaker eventually triggers a round change. The price quorum is therefore a precondition for block commitment, not an optional attachment.
A validator is also only eligible to propose a block if it can demonstrate possession of valid price observations for the current round. G2 is therefore not just an execution-layer property — it is a precondition of block production at the consensus layer.

​
The theorem

Let BB be a committed block with a valid quorum certificate. Let pˉ\bar{p} be the canonical aggregate price vector contained in BB‘s price quorum, and let T=(t0,…,tn−1)T = (t_0, \ldots, t_{n-1}) be the canonical transaction list of BB. Then for every transaction ti∈Tt_i \in T that reads a price during execution, the price read is pˉ\bar{p}. Moreover, the 2f+12f+1 signatures constituting the quorum certificate simultaneously bind the ordering of TT (via the Canonical Sequencing Commitment) and the price vector pˉ\bar{p} (via the in-consensus price quorum). Both are covered by the block hash. Honest validators will not sign a block whose price quorum is ill-formed or inconsistent with its contained observations. Therefore the 2f+12f+1 signers have committed to both the ordering and the price.

​
What this enables

  • Liquidations are evaluated against a price the protocol committed to. A liquidation engine cannot be blamed for using a “wrong” price — the price was certified by the same quorum that committed the liquidation.
  • Funding rates and mark-price updates have verifiable provenance. Each update is traceable to the specific block round in which its inputs were certified.
  • No arbitrage between the oracle path and the execution path. There is only one path.
  • Trust removed from auxiliary oracle committees. There is no committee to trust or attack; the oracle is the validator set, operating under the same fault threshold as consensus.
PTA depends on OTD — the transaction list certified by the quorum must be unambiguous, or “the transaction that consults the price” is not well-defined. With OTD in place, PTA elevates the binding from property to theorem.