Hey, we’re building LON which adopts an optimistic price oracle. Oracle nodes inscribe signed observations on Bedrock channels. A node named proposer takes the first fixed number N (like 50) valid observations of a round, computes the median, and writes it to LEZ in one TX. Anyone can dispute within a window. The crucial point, this proposer can be malicious, that’s why all other oracle nodes also calculate the attested price from the input of N valid observation. To work securely, all oracle nodes need to align on the same set N, otherwise they get result different price, so cannot prevent the malicious one. Maybe I can tag @david
Problem: A node can inscribe several observations for the same round, and they can land in different blocks. Every honest oracle nodes must end up with the exact same first N observations and ignore the rest. Otherwise honest oracle nodes compute different medians, and an honest proposer can be disputed wrongly.
Proposed fix: We want to benefit Bedrock’s own ordering as the canonical order.
- Scan the finalized chain from the round’s start height, in
(height, tx index, op index)order. - Skip invalid observations (bad signature, non-member, wrong round). Keep only the first valid one per
oracle_id. - Stop at the Nth. Its position is the cut key, and the proposer takes observations till the Nth and calculate median, push it to the LEZ.
- Honest oracle nodes all derive the same cut, so they can dispute a wrong cut safely.
What we believe from the code (please confirm):
- Inscriptions in one channel are strictly ordered by
parent == tip_message. - Block TX order is committed in the header via
body_root(TX Merkle root), so TX index within a block is canonical once the block is final (or produced). - The SDK iterates TXs, then ops, in that order (
extract_finalized_items).
Questions:
- Is
(height, tx index, op index)a safe, stable ordering key for finalized blocks? - Is the tx order inside a block free for the leader to choose, or is there a validator rule (fee, hash)? If it’s free, “first 50” inside one block is leader-influenced.
- How many blocks of depth should we require before treating a block as final for this purpose?
Note that: we are using the Logos zone API to design the system (with a sequencer and an oracle nodes) there are (maybe) other things done regarding the blocks?
Thank you in advance!
Refs