Fringe Price Oracle Model
Last updated
Last updated
In realizing Fringe Finance’s vision of DeFi for Everyone, we encounter the issue of the lack of public, reliable price feeds for the vast majority of crypto assets. Chainlink oracles have allowed Fringe to list over 40 different tokens for decentralized, permissionless lending/borrowing, but, to fully support the long tail of crypto assets, no available solution meets our security/cost criteria. Furthermore, TWAP (Time Weighted Average Price) oracles, in their existing design, have proven unreliable and in need of refining to be incorporated into a safe system.
To address this, Fringe Finance is transforming its price oracle model to provide more robust protection against market manipulation attacks while allowing for greater flexibility in choosing price sources. Fringe’s new innovative model encompasses two key components: price processing and price procurement, each vital in ensuring secure asset pricing on the platform.
As explained above, we are introducing two key concepts.
Price procurement lays out rules and facilities regarding how prices are obtained, taking into account factors like user interactions and the use of price-updating bots. Procurement also involves keeping price logs to avoid redundant activity and enable more efficient processing.
Price processing involves incorporating additional price sources and applying a series of operations on the reported prices to bolster system protection.
Fringe’s model supports prices sourced from Chainlink and Uniswap V3, allowing each listed asset to be configured with a price source from either of these providers. The price source provides a ‘reportedPrice,’ which becomes the ‘governedPrice’ after applying a volatility cap rule.
Several treatments are applied during price processing, including deriving a ‘longTWAPprice’ (a Time-Weighted Average Price over a long time, e.g., 24 hrs) and subsequently deriving the ‘finalPrice’ for collateral assets based on the minimum of the TWAP price and the governed price. Capital asset prices are derived based on the maximum of the TWAP price and governed price. Using minimum prices for collateral assets and maximum ones for capital assets further protects the system from manipulation attacks, making them more expensive.
There are three possible price processing paths –full, partial, and non-TWAP. Some assets will not yet have the new price model applied, in which case the existing price oracle model will apply. For assets where the new pricing model is activated, the ‘full’ or ‘partial’ path taken is contingent upon the time elapsed since the most recent long TWAP accumulator was calculated and stored.
Full Processing Path: Applicable when the time elapsed since the most recent long TWAP accumulator log entry exceeds the minimum sample interval. To note, TWAP price processing requires periodic logging of what is called ‘accumulators’ from which the TWAP price can be derived. This path involves executing all price processing steps, including governing the price to limit price movements and deriving the long TWAP price.
Partial Processing Path: Utilized when the most recent accumulator log entry is younger than the minimum sample interval. Here, new long TWAP accumulator entries are neither derived nor stored, avoiding excessive logging.
Non-TWAP Path: Reserved for tokens that do not warrant the gas costs of full or partial price processing due to them not being in high demand on Fringe’s platform. This path only applies price governing without additional processing or utilizing gas-intensive TWAPs.
The price processing paths and related processing steps are depicted in the following diagram:
Fringe’s price processing steps offer benefits such as reducing risks of upward or downward price manipulation and extending the time that it would take to conduct an attack, which makes attacks less profitable for attackers and therefore less likely. The minSampleInterval aids in reducing the risk of excessive gas costs, and the logMaturingAge ensures the long TWAP isn’t solely dependent on very recent price points, thereby enhancing protection against market price manipulation attacks.
An additional benefit is the creation of new opportunities for Fringe. With support for additional price sources, Fringe can now safely list fractionalized NFTs as collateral assets, as well as a wider range of smaller-cap assets that do not have Chainlink price feeds. In addition to that, Fringe can now operate on EVM chains that do not have Chainlink deployed, enabling Fringe to operate on those chains with less competition.
Notably, the new price oracle model supports more efficient liquidations on the Fringe platform by reducing price discontinuations into a smoother curve to ensure borrowers receive better prices for their liquidated collateral during any liquidation event. This is designed to benefit borrowers and therefore promote Fringe’s adoption.
The price procurement model involves interaction-activated price updates and using Fringe-operated price-updating bots. Interaction-activated price updates occur when user operations necessitate a price fetch, while our bots help fill in the gaps when user activity on Fringe for the asset in question is low. Fringe’s price-updating bots also act as a price attack recovery mechanism from suspected market price manipulation events.
The gap-fill requirement ensures that the longTWAPaccumulatorLog maintains sufficient entries for calculating the longTWAPprice. Factors like the most recent log entry (mostRecentAccumLog), log maturing age (logMaturingAge), early warning alert percentage (logAlertPercent), and the long TWAP period influence the bot’s decision to run calcfinalPrices().
Price attack recovery identifies suspected market price manipulation events and calls calcFinalPrices() to refresh prices when these attacks end. The current price’s deviation from the mostRecentGovernedPrice entry by more than a predetermined percentage (suspectedAttackDeviationPercentage) and the age of the mostRecentAccumLog triggers this logic.
This price attack recovery mechanism works hand-in-hand with the Price Processing treatments that minimize the impact of market manipulation attacks to result in protections from and timely recovery from market manipulation attacks.
Despite its innovation, the price oracle model incurs gas costs when logging prices through automated price-updating bots. To mitigate excessive gas costs, Fringe will initially limit the deployment of the mechanism for certain assets until the adoption rates can support these costs, funded via a fraction of the platform fees. With this approach, Fringe is able to provide the added protections of our new price oracle model for assets where users most need it.
The following diagram presents the price procurement architecture:
Fringe plans to refine the model further by introducing incentivized price-updating bots in a future version, replacing the current Fringe-operated ones. This will help further improve the decentralization of the Fringe platform. Fringe will also implement additional enhancements to safeguard against malicious oracle attacks. Furthermore, Fringe may consider using Uniswap v2 as a price source if market demand justifies it. But, to note, UniV2 will require us to undertake additional costly TWAP-related logging, and, therefore, may only be considered for assets in very high demand.
