XOXNO oracle ABI

The XOXNO oracle aggregates prices from registered signers, including feeds for tokenized real-world assets. The contract keeps each signer’s latest submission for each feed. It excludes old submissions from aggregation, then selects submissions within the allowed timestamp skew of the newest eligible timestamp, clamped to ledger time. At least threshold submissions must remain. If the cluster has fewer than 2 * (signers - threshold) + 1 submissions, it must also satisfy highest * 10000 <= lowest * (10000 + max_cluster_spread_bps). A failed count or spread check is a quorum miss. A qualifying cluster produces the lower median. Signatures omit the Soroban-injected Env argument. Construction uses __constructor(admin: Address, signers: Vec<Address>, threshold: u32, resolution: u32) -> Result<(), Error>. The signer set must have no duplicates, and threshold must be between 1 and the signer count. The price aggregator applies additional staleness and sanity checks when using this oracle as a source. See Oracles.

Submitting prices

submit_price(signer: Address, feed_id: String, price: i128, package_timestamp: u64) -> Result<(), Error>
submit_prices(signer: Address, feed_ids: Vec<String>, prices: Vec<i128>, package_timestamp: u64) -> Result<(), Error>

signer must authorize. submit_prices applies one package_timestamp to every entry and fails with #10 LengthMismatch if the two vectors differ in length. package_timestamp is in milliseconds. Every submission is checked against five rules before it is stored:

Rule	Failure
The signer is registered	`#1 NotAuthorizedSigner`
The feed is known	`#14 FeedNotKnown`
The price is positive and in range	`#2 InvalidPrice` / `#9 PriceOutOfRange`
The timestamp, converted to seconds, is no more than 60 seconds ahead of ledger time	`#11 FutureTimestamp`
The submission is not stale, and not older than this signer’s previous one for the feed	`#16 StaleSubmission`

The timestamp ordering rule applies per signer and feed. The aggregate uses the oldest qualifying package timestamp, which may move backwards when the set of qualifying submissions changes. A stored submission immediately recomputes that feed’s aggregate. Submitted prices must be in 1..=1000000000000000000000000. Prices use 8 decimals. History retains at most 12 aggregates. A write within one resolution period replaces the last history entry; a later write appends and evicts the oldest entry when needed.

Reading prices

The contract exposes Reflector-compatible reads and RedStone-shaped bulk reads. All reads are permissionless. History reads can renew storage TTL.

Function	Returns
`lastprice(asset: ReflectorAsset) -> Option<ReflectorPriceData>`	Latest price for a mapped asset.
`price(asset: ReflectorAsset, timestamp: u64) -> Option<ReflectorPriceData>`	History entry with the newest package timestamp at or before `timestamp` (seconds).
`prices(asset: ReflectorAsset, records: u32) -> Option<Vec<ReflectorPriceData>>`	Recent history.
`read_price_data(feed_ids: Vec<String>) -> Result<Vec<RedStonePriceData>, Error>`	RedStone-shaped bulk read, preserving input order; any feed error fails the call.
`read_price_data_for_feed(feed_id: String) -> Result<RedStonePriceData, Error>`	Same, addressed by feed id.
`read_price_history(feed_id: String, limit: u32) -> Result<Vec<RedStonePriceData>, Error>`	Up to `limit` observations, newest write first. Requires a fresh current aggregate and stored history.
`assets() -> Vec<ReflectorAsset>`	Mapped assets.
`feeds() -> Vec<String>`	Registered feed ids.
`base() -> ReflectorAsset`	`ReflectorAsset::Other("USD")`.
`decimals() -> u32`	Price scale: 8 decimals.
`resolution() -> u32`	History resolution in seconds.
`max_stale_seconds() -> u64` / `max_submission_age_seconds() -> u64` / `max_relative_skew_seconds() -> u64`	Freshness bounds in seconds. The skew read is clamped to submission age.
`max_cluster_spread_bps() -> u32`	Price-spread bound for a small cluster.

The RedStone-shaped reads return #7 NoDataForFeed when no aggregate exists. A submission quorum miss retains a previous aggregate; reads can keep serving it until it expires with #8 StaleData. Owner-triggered recomputation and signer removal clear the aggregate if quorum is no longer met. Reflector-shaped reads return None for unavailable or stale data.

Freshness bounds

Submission eligibility and served-price freshness use separate bounds.

Bound	Governs
`max_submission_age_seconds`	How old a single submission may be to count toward the median at all.
`max_relative_skew_seconds`	How far behind the freshest submission a peer may lag before it is dropped.
`max_stale_seconds`	Maximum age of the aggregate’s write timestamp when serving reads.

The consuming source’s max_stale_seconds must cover max_submission_age_seconds and fit within its oracle’s outer staleness bound. The price aggregator checks the earlier of package and write timestamps, so its price can expire before this contract’s write-age check rejects the aggregate.

Administration

The configuration methods below are owner-gated (#[only_owner]). This oracle has its own owner; the lending governance contract has no typed operation that forwards these calls. Read get_owner() to identify the deployed oracle’s authority.

Function	Purpose
`add_signer(signer: Address) -> Result<(), Error>` / `remove_signer(signer: Address) -> Result<(), Error>`	Manages the signer set. Removing below the threshold raises `#6 CannotRemoveBelowThreshold`.
`set_threshold(threshold: u32) -> Result<(), Error>`	Sets N in the N-of-M quorum. `#3 InvalidThreshold` if unworkable.
`set_max_stale_seconds(seconds: u64) -> Result<(), Error>`	Aggregate write-age bound; must cover the configured submission age.
`set_max_submission_age_seconds(seconds: u64) -> Result<(), Error>`	Submission age; at least 61 seconds and no greater than aggregate staleness.
`set_max_relative_skew_seconds(seconds: u64) -> Result<(), Error>`	Timestamp lag bound; greater than 60 and no greater than submission age.
`set_max_cluster_spread_bps(bps: u32) -> Result<(), Error>`	Small-cluster price-spread bound; 1–10000 bps. Stores the value without recomputing feeds.
`register_feed(feed_id: String) -> Result<(), Error>`	Registers a feed id.
`add_feed(feed_id: String, asset: ReflectorAsset) -> Result<(), Error>` / `remove_feed(asset: ReflectorAsset) -> Result<(), Error>`	Adds a Reflector asset mapping; removal deletes the mapping and all underlying feed state and registration.
`set_resolution(resolution: u32) -> Result<(), Error>`	Sets feed resolution.
`recompute_feeds(feed_ids: Vec<String>) -> Result<(), Error>`	Re-derives aggregates. See the warning below.
`purge_feed(feed_id: String) -> Result<(), Error>`	Removes registration, aggregate, history, submissions, and any asset mapping. Register the feed again before submitting new prices.
`upgrade(new_wasm_hash: BytesN<32>)`	Replaces the contract Wasm.

The contract also exposes the OpenZeppelin ownership surface:

Function	Auth / effect
`get_owner() -> Option<Address>`	Open read.
`transfer_ownership(new_owner: Address, live_until_ledger: u32)`	Owner starts a two-step transfer.
`accept_ownership()`	Pending owner accepts within the allowed ledger window.
`renounce_ownership()`	Owner relinquishes ownership, removing access to owner-only configuration and upgrades.

set_threshold, set_max_submission_age_seconds, set_max_relative_skew_seconds, and set_max_cluster_spread_bps store the new value only. Feeds that already hold an aggregate keep serving it under the old rules until a subsequent submission forms a new aggregate or recompute_feeds recomputes or clears it. Call recompute_feeds after a configuration change to apply the new rules. Read staleness limits still apply.

Recompute feeds in batches. Each feed costs roughly one ledger entry per signer plus three, so a full sweep can exceed the transaction footprint limit. Use feeds() to list ids. Simulate each batch to check its resource use.

Error codes

Decode these codes only when the XOXNO oracle is the emitter associated with the final error diagnostic. A top-level controller call can fail in a dependency. See error attribution. Ownership checks also use OpenZeppelin errors, outside this table.

Code	Name	Meaning
`1`	`NotAuthorizedSigner`	The submitting address is not registered.
`2`	`InvalidPrice`	Price is zero or negative.
`3`	`InvalidThreshold`	Threshold is unworkable for the signer set.
`4`	`SignerAlreadyRegistered`	That signer is already in the set.
`5`	`SignerNotRegistered`	No such signer.
`6`	`CannotRemoveBelowThreshold`	Removing would drop the set below the threshold.
`7`	`NoDataForFeed`	No aggregate or required history exists.
`8`	`StaleData`	The stored aggregate is older than `max_stale_seconds`.
`9`	`PriceOutOfRange`	Price outside accepted bounds.
`10`	`LengthMismatch`	`submit_prices` vectors differ in length.
`11`	`FutureTimestamp`	`package_timestamp`, converted to seconds, exceeds ledger time by more than 60 seconds.
`12`	`FeedAlreadyMapped`	The asset already maps to a feed, or the feed id already has an owning asset.
`13`	`FeedNotMapped`	No feed mapped for that asset.
`14`	`FeedNotKnown`	Unregistered feed id.
`15`	`InvalidSubmissionAge`	The configured submission age is out of range.
`16`	`StaleSubmission`	Too old, or older than this signer’s previous submission.
`17`	`FeedAlreadyRegistered`	That feed id is already registered.
`18`	`InvalidRelativeSkew`	Skew is no greater than 60 seconds or exceeds submission age.
`19`	`InvalidClusterSpread`	Cluster spread is zero or greater than 10000 bps.

Oracles

How the price aggregator composes this into a validated USD price.

Oracle disruption runbook

What to do when a feed stops producing an aggregate.

Addresses

Oracle adapter registry addresses and verification steps.

Start here

Core concepts

Lending actions

Strategies and integrations

System behavior

Reference

Operations

Submitting prices

Reading prices

Freshness bounds

Administration

Error codes

Next

Oracles

Oracle disruption runbook

Addresses

​Submitting prices

​Reading prices

​Freshness bounds

​Administration

​Error codes

​Next

Oracles

Oracle disruption runbook

Addresses

Submitting prices

Reading prices

Freshness bounds

Administration

Error codes

Next