Multi-feeder oracle, circuit-breaker, token registry, multi-hop conversion

[Jambox11]

Summary

Four foundational improvements to the price oracle architecture addressing centralization risk, safety guards, and extensibility:

1. Token-Symbol Registry (No canonical token-Address-to-currency-Symbol registry exists anywhere in the protocol #501): Canonical Address↔Symbol mapping eliminates hardcoded assumptions
2. Circuit-breaker (No circuit-breaker / max-deviation check in set_price #500): Configurable max-deviation check prevents catastrophic mispricing
3. Multi-feeder Model (Single-admin set_price with no multi-feeder/aggregation model concentrates conversion-rate trust in one key #499): Authorized independent feeders with median aggregation vs. single-admin concentration
4. Multi-hop Conversion (convert() only supports direct registered pairs with no multi-hop/triangulation through a common base currency #502): Triangulation through base currency for derivable pairs

Changes

#501 — Token-Symbol Registry

• Added DataKey::TokenSymbol(Address) -> Symbol persistent mapping
• register_token_symbol(admin, token, symbol) — admin-gated registration
• resolve_symbol(token) -> Symbol — lookup view
• convert_by_address(amount, from_token, to_token) — convenience entrypoint using addresses
• Tests: registration, resolution, address-based conversion, unregistered error path

#500 — Circuit-breaker with Max-Deviation

• Added DataKey::MaxDeviation (default 1000 bps = 10%)
• set_price() now validates deviation from aggregated price; rejects if exceeded
• set_price_override() bypasses check for legitimate large moves (de-peg events)
• set_max_deviation(admin, bps) — reconfigurable threshold
• Tests: within-deviation success, exceeding-deviation rejection, override bypass, configuration change

#499 — Multi-feeder Model

• DataKey::Feeder(Address) -> bool — admin-managed feeder registry
• DataKey::FeederPrice(Symbol, Symbol, Address) — per-feeder submissions
• DataKey::PriceFeeders(Symbol, Symbol) — tracks which feeders have submitted for each pair
• set_price() now accepts submissions from any authorized feeder
• get_price() aggregates via median across all active (non-stale) feeders
• add_feeder(admin, feeder) and remove_feeder(admin, feeder) — feeder lifecycle
• Tests: single-feeder degenerate case, multi-feeder median aggregation, malicious feeder containment, feeder management

#502 — Multi-hop Conversion

• DataKey::BaseCurrency — configurable currency for triangulation
• set_base_currency(admin, symbol) — admin configuration
• convert() enhanced: tries direct pair first, falls back to triangulation through base
• Both legs independently checked for staleness; fails if either is stale
• Tests: triangulation success, direct-pair preference, missing base currency, staleness on both legs

Architecture Notes

• Backward Compatibility: Single feeder scenario works as before (one feeder authorized, behaves like old single-admin model)
• Median Aggregation: Simple bubble-sort implementation suitable for small feeder sets
• Staleness: Applied per-feeder for individual submissions; median calculated from non-stale submissions only
• Deviation Check: Compares against current aggregated (median) price, not individual submissions
• Token Registry: Independent of pricing; can be used by other consumers for address→symbol resolution

Test Coverage

✅ Token registry: registration, resolution, address-based conversion, error paths
✅ Circuit-breaker: deviation success/failure, override bypass, reconfiguration
✅ Multi-feeder: single vs. multiple, median correctness, malicious containment, feeder management
✅ Multi-hop: triangulation success, preference hierarchy, missing base, staleness checks
✅ Existing tests: all converted to new feeder model

Closes #499, Closes #500, Closes #501, Closes #502

[drips-wave]

@Jambox11 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits