Security begins with independent evidence.
TezOracle establishes integrity across the full price path, from market observation and independent validation through oracle consensus, on-chain verification, activation, and downstream use.
TezOracle is designed around the failure modes that matter in production oracle systems: source anomalies, key compromise, implementation defects, operator outages, replayed data, and economically unsafe prices.
Independent signer attestations establish authorization, with a cryptographic signature authenticating each attestation. Independent software paths reduce correlated validation failure. Versioned market policy governs observation quality. Activation delay and consumer controls limit downstream exposure when a price path becomes uncertain.
Every update is validated through policy, context, and oracle consensus.
Each accepted price update begins with approved market evidence, passes through independent validation paths, carries the required signer attestations, and is bound to its destination. After on-chain verification, the pending price becomes active at the activation boundary.
Each signer attests only to the price independently derived from approved observations under the active policy.
Freshness, deviation, source-count, liquidity, precision, and normalization rules come from a versioned policy.
An authorized price update carries attestations across independently operated validation paths so consensus reflects diverse market evidence and implementation paths.
An accepted update establishes a pending price that crosses an activation boundary before becoming eligible for risk-increasing financial actions.
Layered controls protect the path from source to consumer.
Source quality, software diversity, signer authorization, contract verification, formal specification, and consumer risk controls form overlapping layers around the price path.
Market-source integrity
Minimum healthy-source counts, market-specific liquidity requirements, observation timestamps, executable-size checks where applicable, and bounded cross-source deviation establish the accepted observation set.
Validate market evidenceIndependent validation
Separate critical implementations retrieve, normalize, and derive the price independently under the same published policy. Each signer attests only when its own path reaches an acceptable result.
Diversify software riskThreshold authorization
The oracle verifies authorized signer attestations and signatures, required consensus conditions, validation-path representation, destination domain, update ID, observation time, expiration, and policy commitment.
Authorize by consensusActivation boundary
A newly accepted update establishes a pending price that crosses the activation boundary before risk-sensitive consumers use it as the active price.
Add reaction timeFormal specification
Michelson is designed to facilitate formal verification. TezOracle keeps critical contract invariants explicit so they can be formally specified and accompanied by machine-checked proofs as those proof artifacts are completed.
Prove critical propertiesConsumer containment
Integrators apply maximum age, future-time checks, absolute bounds, maximum change, conservative valuation, exposure caps, and targeted pauses appropriate to their own protocol.
Bound downstream exposureProtective mode preserves safe recovery paths.
When a fresh price update cannot be authorized, the oracle stops advancing the active price and each consumer transitions according to its own age and risk policy. Repayment and other clearly exposure-reducing actions should remain available where the protocol can support them safely.
Production follows verified operation.
Implement small, reviewable milestones against the published architecture and security specification.
Add independent review, attack tests, and invariant checks across contracts, validators, relayers, and consumers.
Exercise source failures, signer loss, stale updates, anomalous markets, and degraded operation on testnet and in shadow mode.
Freeze the production candidate, complete independent security review, remediate accepted findings, and re-review the final candidate before activation.