Oracle and signed quotes

O2 source

The Oracle Worker reads O2 PriceUpdated events through Envio HyperFuel. It queries a bounded range ending ten blocks behind head and selects the latest finalized event for the configured source asset.

Validation

A source observation is rejected when it is absent, zero, stale beyond 60 seconds, more than 30 seconds in the future, inverted, wider than 200 bp, or incompatible with nine collateral decimals. The conservative bid is floored from 18 decimals to the Vault's six-decimal price.

Transient HyperFuel failures are retried three times. Public display prices refresh every 15 seconds and the frontend keeps the last validated observation for estimates. Transaction quotes never use that stale display fallback.

Signed quote

Each deposit requests a fresh uncached quote bound to:

network domain | vault contract | collateral asset | price | issued | expiry | nonce

Quotes expire after 120 seconds and nonces are one-use. Responses use Cache-Control: no-store. The signing key remains a Worker secret and can be rotated on-chain.

stFUEL

On testnet, tFUEL and tstFUEL intentionally use the same per-unit O2 FUEL price while signatures bind them to distinct collateral asset IDs. This is a simulation, not an authoritative stFUEL exchange rate. Mainnet stFUEL remains disabled until one is approved.