Price oracles
Prices enter the protocol as signed attestations verified onchain, with Chainlink feeds as the primary source and a band-limited in-house signer filling gaps. Trade prices are never used as an oracle.
Architecture
| Component | Role |
|---|---|
| Chainlink feeds | Primary price source per ticker on Robinhood Chain |
| In-house KMS signer | EIP-712 signed attestations; fills feed silences and serves market-session data; band-limited against the Chainlink anchor |
| ChainlinkOracleVerifier | Onchain verification: signatures, staleness, deviation bands, monotonic sequencing |
| Keepers | Permissionless: anyone can push a fresh verified price and re-stamp marks |
Guards
| Guard | Setting | Purpose |
|---|---|---|
| Deviation band | 5% (SPY, QQQ), 8% (single names) | An in-house signature cannot move the price further than this from the Chainlink anchor, bounding a leaked signing key |
| Feed silence threshold | 15 minutes | The in-house signer only quotes when the Chainlink feed has been quiet longer than this |
| Fresh window | 4 hours | How long a feed price stays usable |
| Anchor age limit | 5 days | Oldest acceptable Chainlink anchor for band checks |
| Mark freshness (to mint) | 1 hour | New eToken exposure cannot open against an older mark |
| USDG config | Chainlink-only, 0% band | The payment token needs no in-house override |
Marks
The mark is the protocol's cached working price per asset and per collateral, refreshed only from verified oracle prices. Every settlement checks its quote against the mark (the ±5% settle band) and every new-risk path checks the mark's age. Off-hours, marks persist at the last session's anchor, which is what eUSD exits and PSM redemptions price against.
Failure behavior
- A stale feed makes an asset read as stale to freshness-checking consumers: new risk pauses, exits continue.
- A compromised in-house key is bounded by the deviation band and the monotonic sequence check.
- Oracle infrastructure is upgradable through the ProtocolRegistry, which is how the protocol migrated from its original signer-only design to Chainlink-primary in July 2026 with a preserved rollback path.