Price and oracle

Spec v0.9.1, reviewed 2026-09-08

The price a position is measured against is not read from one feed. It is the median of three families of markets, delivered by at least two independent infrastructures, clamped around the last accepted exchange print. That design removes the single point of failure and replaces it with a different set of exposures, which this page states.

The mechanism itself is on The composite price and Price regimes. What follows is what can go wrong with it.

The source set is fixed before deployment and can never be changed

Every pool, every feed identifier and every reporter key is written into the constructor. There is no function to add a source, remove one, reweight one or replace one, and the Closer key does not know the oracle contracts exist.

What that buys. Nobody can point the protocol at a price of their choosing. The most common failure in real-world-asset lending is an administrator swapping an oracle; here the function does not exist.

What is left over. A source that dies stays dead. If liquidity migrates from a listed Uniswap pool to one that is not listed, that pool's contribution goes to zero and the family it belongs to thins out. If the signed path stops being verifiable, it stops counting. The branch degrades, then freezes, then closes itself after 7 days without a valid exchange price. Nobody repairs it.

What it costs to move the median

An attacker who wants a healthy position liquidated has to be a Stability Pool depositor, because the pool is what buys, and then push the composite below the true price so that the pool buys cheap. Both halves are needed, and the second one is priced.

Moving one family is not enough: the median ignores the extreme family. The cost is therefore the cost of the second cheapest family, in addition to the first.

Even granting all of it, the gain is bounded by what sits inside the window that the manipulation opens. On a branch at its largest ceiling, positions between the liquidation threshold and a few points above it are a small share of the debt, the discount is 4% at most, and the attacker collects only their own share of the pool. The design's own arithmetic puts the gross gain two orders of magnitude below the cost.

The same price feeds the borrowing limit, and that is sampled defensively

The composite is also what the volatility oracle records to set each branch's borrowing limit of the day. Three properties keep that from becoming a cheaper way to attack the same number.

The sample is taken once per fixed 24-hour slot aligned on midnight, not on a rolling timer, so nobody can choose when it falls. It is the median of 3 readings rather than a single one, so a price held wrong for one block is not the day's sample. And a corporate action no longer erases the history, so a split cannot be used to reset a branch to its cautious prior.

Pushing the limit down therefore means holding the composite wrong across the medians of several fixed slots, at the costs in the table above, to remove a few points of borrowing capacity for a week from people who can simply wait. Pushing it up is not available at all: a realised variance cannot be un-realised, and skipping a sample does not reduce it.

Five named reporters, and what three of them can do together

Five keys are fixed at deployment. Each signs the price it reads on a public venue, and a bundle is accepted with 3 signatures out of 5 whose spread is at most 0.5%. The stored value is the median of what they signed. A reporter can renounce; none can ever be added.

Three of them acting together can sign anything. Here is the whole of what that achieves.

What is left is a denial of liquidation, lasting exactly as long as they lie, visible in the published dispersion, and costing them three public reputations. The residue is real on a branch whose only non-reporter group is absent: there, the reporters lying and the reporters being absent produce the same frozen state.

The signed path depends on infrastructure nobody here controls

Two of the three families arrive as signed messages. One path is verified against the Wormhole guardian set; the other against the five reporter keys.

If the guardian set stops producing verifiable attestations, or the message format changes, that whole path dies at once across all twenty branches. The design has walked through the consequence: the index branch keeps its pools and its reporter venues and stays in the full regime; the gold branch keeps its metal feeds; the branch whose only signed source was that path freezes.

There is no fallback, because a fallback is a second oracle chosen by somebody. The specification is explicit that a source is never replaced, and that this is the price of having no administrator.

The chain itself

Robinhood Chain has one sequencer. It can filter or reorder transactions, and whether a verified uptime feed exists is one of the pre-deployment checks. If none exists, the protocol has no cause to detect a sequencer outage and simply sees stale prices.

While the sequencer is down, nobody can repay, nobody can add collateral, nobody can liquidate, and no price arrives. When it restarts, everything that accumulated arrives at once. The protocol's answer is the 600 seconds during which the pool executes nothing after a price returns, which bounds the race but does not remove it.

Freezing and halting are different, and the difference is the point

The word people reach for is "the oracle is down". The protocol distinguishes two states, and confusing them is the most common misreading of the design.

A frozen branch is the protocol declining to act on a number it does not trust. It is not a failure state and it does not lead to a shutdown: only 120 hours without any exchange price, while frozen, escalates to a halt, and only 7 days of continuous halt closes the branch.

What is measured before any of this is frozen

The source registry, the quality weights, the dispersion thresholds and the confidence reference are all calibrated on measurement, not on judgement, and every one of them is blocking. The window and the failure response for each are on What is measured before launch.