Per validator — off the consensus path
Inside consensus
Trading venues
Oracle sidecarone per validator
The validator validates and signs
Gossiped between validators
Certified per epoch and round
Carried in the block
Kernel — mark price · margin · liquidation · fundingsettles against the prices committed in the same consensus event
Producing an index price
Every validator runs its own oracle sidecar, which collects data from multiple trading venues and reduces it to one index price per instrument. The reduction is deliberately not a plain average — an average is trivially moved by one bad source.Filternon-finite and malformed values
Medianacross sources
Clampeach source to median ± band
Weightby spread and stability
Capby venue tier
Index price
The order is the designFiltering runs first because one infinite value surviving into a median or a weighted sum contaminates everything after it. Clamping rather than discarding keeps every source counted while bounding how far any one can pull.
Not a plain average — an average is trivially moved by one bad source
A source quoting outside its band is not discarded — it is pulled to the edge of the band. That distinction matters: discarding lets an attacker shrink the sample, while clamping keeps every source counted but bounds how far any one of them can pull.
Weight by quality, then cap. Clamped sources are combined by weighted mean rather than equally. Weight rises with quote quality — a tighter spread counts for more — and with stability, measured by comparing recent volume against a longer-run daily average, so a venue with an unusual volume spike does not gain influence from it.
Weights are then capped by source tier, so no single venue can dominate the result regardless of how good its quotes look:
Cross-quoted instruments are converted to a common quote currency before any of this, so a median is taken over comparable numbers rather than mixed denominations.
Every constant here is a policy decision, not a natural constant. Deviation bands, tier assignments, and weight caps are configuration, and they are the levers that get tuned when a venue’s behavior changes or a new source is added.
Certifying it
The index price a sidecar produces is one validator’s opinion. Turning it into something the network can settle against happens in consensus. The validator pulls the price from its own sidecar and validates it before signing — including freshness against a configured threshold, so a stalled sidecar produces no submission rather than a stale one. It then signs the price data and gossips the signed submission to other validators as a consensus network message. Certified prices are assembled per epoch and round and carried in the block proposal. The signatures that commit the block’s transactions therefore also commit the prices those transactions settled against — there is no separate oracle transaction, and no window between a price being published and being used. A validator cannot propose a block without valid price observations for the round. Price availability is a precondition of block production, not an input that execution hopes to find.Index price and mark price
The certified price is the index price — the network’s view of the external market. It is not the price at which trades execute. The kernel derives a mark price from it, smoothed and bounded so that a brief dislocation in the index does not cascade into liquidations. Mark price is what margin, liquidation, and funding actually use. See Mark price and Index price for the trading-side view.What this does and does not guarantee
It guarantees that the price a transaction settled against was certified by a validator quorum at the round that committed the transaction, and that no execution path could have read a different one. It does not guarantee the price was right. If the venues an index is built from are themselves wrong — through a coordinated move across several of them, or a market-wide dislocation — the clamping and weighting bound how far a single source can push the result, but they cannot manufacture information the market did not have.Where to go next
IntentionBFT
How certification is bound into the same signatures that commit the block.
Clearinghouse
What margin, liquidation, and funding do with the price.
Mark price
How the index becomes the number that moves positions.
Risk disclosures
Where price risk remains, and what it can cost.