Skip to main content
An oracle disruption blocks operations that require the affected price. Identify the failed source or validation rule, restore trustworthy pricing, and verify all dependent assets. See Oracles for source configuration and resolution rules. A rejected price prevents use of that observation. It does not establish whether affected accounts remain solvent while liquidations are blocked.

​
Affected operations

​
Triage

Inspect both source readings, their timestamps, and the reported error before changing configuration. Match the error code and emitting contract from the same raw diagnostic event. A handled nested failure can precede the final propagated error. Preserve the original diagnostics; display helpers can omit the contract, metadata, or success flags. Interpret the table only after identifying the emitting contract.

​
Check publication timing

A deviation-triggered feed may publish only when its price moves. A heartbeat feed publishes on a fixed cadence. Age alone cannot distinguish an unchanged price from a stalled provider; confirm provider health and its publication policy. Three timing checks apply:
  1. max_stale_seconds limits each source’s age and must cover its verified publication interval.
  2. MAX_LEG_AGE_SPREAD_SECONDS limits the age difference between two Market legs to 3,600 seconds, even when both pass their individual budgets.
  3. max_price_stale_seconds limits the resolved oracle’s age. Source budgets must fit within it, and nested references also enforce their own bounds.
A Fundamental leg is exempt from the market-leg spread check. That classification means the feed reports fundamental value; it is not a workaround for a slow market-price feed. Raising a source’s age budget does not relax the spread check.

​
Check shared references

A nested reference error invalidates dependent oracle resolution. An error in the first source can stop resolution before the second source is read; an error in the second source also invalidates the result. A healthy partner does not replace a required failed source. When multiple assets fail, inspect shared references first. After repairing a reference, verify every dependent price. set_oracle structurally revalidates dependents without reading live provider prices, so a successful update does not prove they can be priced.

​
Recovery

1

Classify the fault

Compare source timestamps and errors with provider health and publication policy. Distinguish missing submissions, incorrect observations, and configuration that rejects the provider’s legitimate cadence.
2

Repair the source or configuration

Restore the provider, or configure a replacement through governance. For a verified configuration fault, correct freshness budgets and source definitions through governance. Set feed nature according to the value it represents.
3

Recompute XOXNO oracle feeds when required

If changing thresholds, submission age, relative skew, or cluster spread, follow the XOXNO oracle administration rules. These setters do not recompute stored aggregates; use recompute_feeds in bounded batches. A cluster smaller than 2 * (signers - threshold) + 1 must also pass max_cluster_spread_bps. A spread failure is a quorum miss.
4

Verify all dependents

Read a price for every affected market and reference key. For quotes, require valid: true and investigate error_code on failures. Confirm affected risk-dependent operations can be simulated with those prices. False stale and deviation flags alone do not establish a usable price; resolution errors can leave those fields zeroed.
Widening sanity or tolerance bands does not fix stale data. Restore reliable prices before resuming affected liquidations; unpausing does not bypass price validation. A configuration update alone does not close the incident.