> ## Documentation Index
> Fetch the complete documentation index at: https://docs.intention.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Price-Transaction Atomicity (G2)

> The price a transaction uses for settlement was certified by a 2f+1 validator quorum in the same consensus event that committed the transaction.

Price-Transaction Atomicity (PTA) is the second of Intention's four protocol-native guarantees. It eliminates, by construction, the oracle failure modes that are endemic to oracle-as-contract designs.

## Definition

Let $B$ be a committed block containing a price quorum $Q(B) = (\bar{p}, \sigma)$, where $\bar{p}$ is the canonical price vector and $\sigma$ is a $2f+1$ stake-weighted aggregate signature over $(\bar{p}, \text{round}(B), \text{epoch}(B))$. For any transaction $t \in B$ that consults a price during execution — mark price, liquidation trigger price, funding-rate reference — the price read by $t$ is exactly $\bar{p}$.

There is no execution path that reads a price other than $\bar{p}$. There is no path through which $\bar{p}$ can be read outside the signature envelope of $B$. The same $2f+1$ signatures that commit the transaction also commit the price it used.

## Why it matters

PTA eliminates three classes of oracle failure that recur in oracle-as-contract designs on general-purpose chains:

* **Oracle race.** A separate oracle committee operates on a different cycle from execution, and there is a timing competition between them. Under PTA there is no separate oracle committee — the validator set is the oracle.
* **Stale-price window.** A price is pushed on-chain at time $t_1$ and the transaction that consumes it lands at $t_2 > t_1$. Under PTA, price and transaction are committed in the same consensus round.
* **Oracle / execution divergence.** Different prices are visible on different paths — one visible to a liquidation contract, another to a matching contract. Under PTA there is exactly one certified price vector per block, and all paths that read a price read the same one.

These are not engineering bugs introduced by sloppy implementations. They are structural consequences of keeping price and execution on separate cycles. PTA removes the separation.

## How Intention enforces it

PTA is the joint property of two mechanisms from [IntentionBFT](/architecture/intention-bft): the in-consensus price quorum and the block structure that embeds it.

**In-consensus price quorum.** Each validator runs a price observation pipeline that collects market data from a set of approved external venues and produces signed observations. Observations are aggregated via a **stake-weighted median with MAD-based outlier rejection** (see [Oracle](/architecture/oracle) for the details). A block leader combines the aggregate with a signature over the contributing observations to form a price quorum certificate.

**Block structure.** The price quorum is embedded in the block proposal so it is covered by the block hash — and therefore by the $2f+1$ signatures that commit the block. When validators verify a proposal in the prepare phase, they verify that the aggregate signature is valid, that the combined stake of contributors strictly exceeds $2S/3$, that the aggregate is the correct output of the aggregation rule applied to the contained observations, that the observations are within a protocol-defined staleness bound, and that the leader's own observations are consistent with the aggregate within MAD bounds — a sanity check that prevents a faulty leader from fabricating contributions.

If any check fails, the validator withholds its vote, the quorum is not collected, and the pacemaker eventually triggers a round change. **The price quorum is therefore a precondition for block commitment**, not an optional attachment.

<Note>
  A validator is also only eligible to propose a block if it can demonstrate possession of valid price observations for the current round. G2 is therefore not just an execution-layer property — it is a precondition of block production at the consensus layer.
</Note>

## The theorem

Let $B$ be a committed block with a valid quorum certificate. Let $\bar{p}$ be the canonical aggregate price vector contained in $B$'s price quorum, and let $T = (t_0, \ldots, t_{n-1})$ be the canonical transaction list of $B$. Then for every transaction $t_i \in T$ that reads a price during execution, the price read is $\bar{p}$. Moreover, the $2f+1$ signatures constituting the quorum certificate simultaneously bind the ordering of $T$ (via the Canonical Sequencing Commitment) and the price vector $\bar{p}$ (via the in-consensus price quorum).

Both are covered by the block hash. Honest validators will not sign a block whose price quorum is ill-formed or inconsistent with its contained observations. Therefore the $2f+1$ signers have committed to both the ordering and the price.

## What this enables

* **Liquidations are evaluated against a price the protocol committed to.** A liquidation engine cannot be blamed for using a "wrong" price — the price was certified by the same quorum that committed the liquidation.
* **Funding rates and mark-price updates have verifiable provenance.** Each update is traceable to the specific block round in which its inputs were certified.
* **No arbitrage between the oracle path and the execution path.** There is only one path.
* **Trust removed from auxiliary oracle committees.** There is no committee to trust or attack; the oracle is the validator set, operating under the same fault threshold as consensus.

PTA depends on [OTD](/architecture/otd) — the transaction list certified by the quorum must be unambiguous, or "the transaction that consults the price" is not well-defined. With OTD in place, PTA elevates the binding from property to theorem.