← XDChain Oracle
Security & Trust
How XDChain Oracle resists manipulation, stays honest, and what's verified vs in progress. Last reviewed 2026-06-23.
Architecture & threat model
- Multi-source median. Every market feed is the median of multiple independent providers (e.g. CoinGecko, CryptoCompare, Binance, Coinbase for crypto; exchangerate-api + open.er-api for FX; PAXG + XAUT for gold). A single API being wrong, stale, or manipulated cannot move the published value.
- Deviation + heartbeat publishing. Values push on-chain when they move beyond a per-feed deviation threshold (bps) or at a max heartbeat interval — bounding both staleness and the cost of spam.
- Signed payloads. Each off-chain feed is signed with Ed25519; consumers verify against the published key (
/api/oracle/pubkey). Message format v1:{feed_key}:{answer_raw}:{decimals}:{signed_at}. A SHA-256 content hash lets you pin a value to an on-chain anchor.
- Fixed-point, Chainlink convention. All values are int256 with 8 decimals, read via the standard
AggregatorV3 interface — no bespoke decoding, fewer integration bugs.
- Honest labeling. Feeds without a genuine free data source are explicitly flagged
data_status: simulated and are never presented as real market data.
Contracts
| Contract | Address | Source |
|---|
| XDCOracle (core) | 0x17e46C9697c99a996a4230761e73a9452E7D603E | verification in progress |
| AggregatorV3 proxies (×6) | see /api/oracle/addresses | verification in progress |
Compiler: solc ^0.8.19, optimizer enabled (200 runs). Standard-JSON input is published for reproducible verification on XDCScan.
Status
| Control | Status |
|---|
| Multi-source median aggregation | ✓ live |
| Ed25519-signed payloads + content hashes | ✓ live |
| On-chain anchoring (XDC mainnet) | ✓ live |
| Public status & uptime page | ✓ live (/oracle/status) |
| Explorer source verification | in progress |
| Independent third-party audit | planned |
| Redundant pushers / failover | planned |
Known limitations (full transparency)
- Single operator. Updates are currently pushed by one operator key. Data sourcing is decentralized (multi-source median); the push path is not yet. Redundant pushers are planned.
- Free-tier data sources. Public APIs can rate-limit; the median tolerates individual source failures, but extreme simultaneous outages reduce source count (surfaced as
sources in /public).
- Proof-of-reserve for RWA assets requires the issuer's audited reserve attestation; the framework is built (
/api/oracle/por/{asset}) but reserves are marked pending until that feed is provided.
Report an issue
Found a problem? Responsible disclosure: ripitlabs.com. We respond fast.