Oracle Risk
On this page
An accepted oracle price can still be wrong, and unavailable prices can delay settlement. Validation bounds what the adapter accepts; it does not certify the underlying market price.
What the Adapter Mitigates
The OracleAdapter reads the closing print (the last round stamped no later than closeTs and no earlier than closeTs − maxPreCloseLag; a Pyth Pro round must also be posted within closeGrace, 5 minutes, of the close), cross-checks a backup feed within 3% and prefers the fresher of the two when only one printed near the close, defers when unsure, and gives governance a delayed, evented override only after 72 hours.
These checks exclude specified invalid rounds but cannot detect all erroneous prices.
The target is a closing print, not the latest price at the time of the call. However, a bounded history walk, retained rounds, feed availability and configured freshness checks can affect whether that close can be resolved. A delayed call can therefore defer rather than return a price.
What Remains
| Residual risk | Effect | Mitigation |
|---|---|---|
| Feed reports a wrong close within tolerance (e.g. a 2% error) | Wrong coupon or, near the barrier, wrong settlement | Backup feed deviation check catches only disagreements above maxDeviationBps |
| Both feeds share an upstream data source that is wrong | Same as above, undetected | Choose feeds with independent sources where available |
| Feed publishes nothing inside the close window (idle, outage, unregistered holiday) | Observation deferred and cannot recover on its own: later rounds never qualify | A wider permitted window does not ensure a valid or sufficiently fresh print. Retry or use the governed failure path where applicable |
| Pre-close print differs from the actual closing market price | Coupon or settlement can differ near a threshold | Feed deviation triggers are not a bound on the error at the close; two accepted feeds still have to agree |
| Pyth Pro governance set compromised or a wrong signed update posted | Backup round wrong | Deviation check against the Chainlink primary defers on a disagreement above 3 %; Pyth governs its governance set on the verifier contract |
| Pyth Pro print posted after the grace end carrying a publish time inside the window | Backup round would look like a closing print | The adapter selects PythProFeed rounds by the block time they were posted (postedAt), so a round appended after closeTs + closeGrace is never used for that close |
| Feed unreachable when the keeper calls | Observation deferred; coupons delayed | Retry once the feed answers again: the closing print still qualifies |
| Feed stops updating for days | Observations deferred; coupons delayed; maturity delayed | Governance force or cancel after 72 h |
Feed decimals or uiMultiplier semantics change | Systematic mispricing | Feeds are governed per underlying; changes require a governed setFeed. A PythProFeed stores the multiplier per round and rejects a changed multiplier until its owner acknowledges the corporate action |
| After-hours or overnight print offered as a close | Wrong session priced | The adapter never selects a round stamped after the close, and PythProFeed accepts regular-session prints only |
| Governance forces a wrong price | Direct loss to one leg | forceDelay of 24 h with an event; guardians and the community can react; cancelling instead is the conservative path |
| Corporate actions (splits, dividends, spin-offs) | s0 and later prices are no longer comparable | Stock Token issuers adjust token quantities or feed values per their own rules (Robinhood docs); governance may cancel affected observations. Series should avoid known event dates where possible |
| Calendar misconfiguration (missed holiday) | Observation falls on a non-trading day; the feed is idle, so the observation defers and needs governance | Governance registers holidays ahead; tests pin US holidays and DST for 2026 to 2030 |
What "Settles at Last Good Price" Means
If governance cancels the maturity observation, NoteCore settles at lastPrice, the last successfully observed price. This avoids an indefinite lock but means maturity economics are those of an earlier date. Cancellation is a last resort after both feeds have failed for 72 hours.
Reference Price
The reference price used during Subscription (referencePrice, of which latestPrice is the price component; the last official close while the market is shut, the latest print during the session) affects only the required prefund and the pro-rata bookkeeping of SHIELD deposits.
If the stock moves sharply between deposit and strike, a SHIELD depositor’s prefund may be insufficient for the matched notional at s0; matching then falls back on prefundCapacity, and the excess stock is refundable. Depositors can over-prefund to avoid this.
Reading the State
OracleAdapter.peek(feed, closeTs) returns what observe would without effects ((0, false) until the grace has elapsed). resolvableAt(closeTs) is the first second at which observe is accepted. deferredSince(feed, closeTs) reports when a deferral began. Watch ObservationDeferred events and the adapter’s force-proposal events.
Keep exploring, or revisit this topic from the navigation.