Oracle System

Oracle System

The price aggregator supplies USD valuations for lending. It is a separate, governance-owned contract: the controller requests prices, then uses them to value collateral and debt. A price required for solvency must be usable; unavailable or unsafe prices stop that operation.

Pricing is configured by token address, shared across hubs and spokes. Named reference keys support intermediate values such as a quote asset or benchmark. Spokes set their own risk parameters but do not override token prices. See Architecture Overview for contract responsibilities and Risk and Liquidations for how valuations affect borrowing and liquidation.

An asset price can come from direct feeds, a factor multiplied by another price, or an LP valuation. A configured two-source price requires both sources to be usable and agree within tolerance; it never falls back to a surviving leg. Accepted prices must also pass freshness and sanity checks. See Oracle Configuration for providers, composition, smoothing, independence, and listing constraints.

Which operations need prices

Oracle exposure follows the operation's valuation requirements. Skipping a price read does not waive authentication, pause policy, liquidity constraints, or other transaction checks.

Flow	Price requirement
Supply	Conditional: updating an existing collateral position's liquidation terms can require a strict portfolio valuation when the account has debt.
Repay	No controller oracle valuation.
Borrow	Strict valuation of the supply and debt portfolio.
Withdraw with no debt	No solvency price read.
Withdraw with debt	Strict account valuation; a liquidation-parameter refresh can also require an earlier valuation.
Liquidate, bad-debt cleanup, and forced socialization	Strict portfolio valuation.
Multiply, swap collateral, swap debt, and repay with collateral	Strict upfront portfolio and action-token prices, including routes that finish debt-free.
Flash position	Strict upfront prices for the portfolio, debt tokens, and declared collateral tokens.
Blend migration	Strict upfront prices for the portfolio, declared withdrawn tokens, and tokens covered by debt caps.
Plain flash loan	No controller oracle valuation; the receiver's callback can impose its own dependencies.
LTV-only account-threshold refresh	No price read.
Full account-threshold refresh	Strict portfolio valuation for each account processed, including debt-free accounts; missing metadata, empty supply, or unresolved ownership are skipped.

Supply's conditional read occurs when a refreshed tuple lowers the liquidation threshold or fee, or raises the liquidation bonus, while debt exists. The controller prices a hypothetical account to decide whether those terms can be adopted at health factor at least 1.05. It does this before crediting the new deposit to that position. An oracle failure can therefore block a supply that would otherwise improve solvency.

An oracle outage does not by itself block an ordinary repayment or a debt-free withdrawal. It can block liquidation or a collateral-funded repayment. Strict portfolio reads request all position-token prices, including collateral with zero LTV or zero liquidation threshold. Strategy finalization reuses the invocation's cached prices; reaching a debt-free result does not undo its upfront oracle dependency. See Flash Loans and Strategies for each route and Central Pool for cash constraints.

Strict reads and diagnostic quotes

The aggregator exposes separate interfaces for consuming prices and inspecting problems:

Interface	Failure behavior
prices(keys)	Reverts if any requested key cannot produce a usable price. This is the controller's lending-price path.
price_spread(key)	Requires a usable price, then returns the lower and higher configured leg values.
quotes(keys)	Returns per-key status, including validity, staleness, deviation, available leg values, and an error code. An unusable key need not revert the whole quote request.

Provider read failures are caught where supported and represented as unusable observations. A diagnostic response can therefore explain a failure without admitting its price into lending. Integrations must inspect valid; a displayed midpoint or surviving leg is not permission to borrow or liquidate. Host-level failures and resource exhaustion can still abort a quote request.

Detailed market-index views use diagnostic quotes. Views that calculate USD balances, health, or liquidation plans use strict prices for the positions they value; health and liquidatability views can skip pricing when no debt exists. Neither kind reserves a price or guarantees a subsequent transaction: the mutation evaluates its own state and ledger time.

Trust and availability

A valid price means the configured checks passed. It does not prove the providers are honest or economically independent. Shared operators, exchanges, or explicitly shared dependencies can move both values together. Manipulation that stays within the configured bounds can also remain undetected.

The XOXNO oracle has a separately administered signer set. Its quorum and freshness rules are another trust boundary, not a guarantee of an honest price. An accepted older aggregate can remain available until its freshness budget expires. Oracle Configuration explains signer aggregation and the duties of operators selecting feeds, classifications, and age budgets.

An outage can stop new risk and also block liquidations, leaving debt exposed while prices are unavailable. Strict failure behavior does not establish source honesty; see Security for the wider threat model and Health Factor and Collateral for how prices affect account health.

References

• Oracle Configuration: source composition, admission checks, and operator controls.
• Managing Positions and Risk and Liquidations: transaction rules and liquidation behavior.
• Governance and Timelock: configuring prices and tightening sanity bands.
• Endpoint reference: price and quote interfaces.
• Error reference: failure identifiers.