Eight lines. Trustless by default.
Trusttheoracle.Verifytheintegrator.
Trustless Layer 1 validates every Reflector read on-chain — deviation, staleness, cross-source. Two more guards activate with opt-in Layer 2.
use safe_oracle::{lastprice, SafeOracleConfig}; let price = lastprice( &env, &asset, &reflector, ®istry, &SafeOracleConfig::default(),)?;// Layer 1 validated. Layer 2 opt-in.The Attack
$10.2Mdrained.
On February 22, 2026, an attacker manipulated a thin SDEX market with a single $5 trade to inflate collateral valuation on a Stellar lending protocol. They walked away with $10.2 million.
Reflector worked. Stellar worked. Blend V2 worked. The oracle reported the price it observed. The protocol trusted it.
The gap was integrator-side. safe-oracle closes that gap.
The Solution
Three trustless by default.
Two more, opt-in.
Layer 1 runs on pure on-chain Reflector math — no off-chain trust. Layer 2 adds market-microstructure defense, opt-in because it relies on attested liquidity snapshots. Each guard closes a specific attack vector seen in real DeFi exploits.
How It Works
Five steps. One result.
Reflector Call
Your contract calls safe_oracle::lastprice() instead of Reflector directly.
Layer 1 — Oracle Checks
Default, trustless. Deviation, staleness and cross-source disagreement validated with on-chain Reflector math — no off-chain dependency.
Layer 2 — Market Checks
Opt-in (layer2_enabled). SDEX 30-minute volume and unique-trader count, validated against attested liquidity snapshots.
Circuit Breaker
Auto-halt after the first violation. Governance manual override available.
Result
Validated price returned — or Err with the specific violation type.
Architecture
Purely defensive.
Run a scenario and watch a borrow request flow through every guard — three trustless by default, plus Layer 2 when enabled — validated before it ever reaches your business logic.
Mechanism
Mathematically validated.
Every threshold below is calibrated for production deployment. Each is configurable per-integrator. Defaults reflect mainnet-grade security margins observed against real attack patterns.
Infrastructure
Modular by design.
Six independent components. Adopt the whole stack or only the guard you need — each is a clean, isolated boundary.
Layer 1 Guardrails
Deviation, staleness, cross-source. Trustless on-chain Reflector math — on by default, no attester.
Layer 2 Guardrails
Liquidity volume + thin sampling. Opt-in (layer2_enabled); validates attested SDEX snapshots.
Circuit Breaker
Auto-halt on first violation. Per-asset isolation. Manual governance override.
Liquidity Registry
Signed snapshots from off-chain attesters. Authoritative source for Layer 2 checks.
oracle-watch
Rust service. Monitors SDEX, signs snapshots, dispatches Slack / PagerDuty / webhook alerts.
Soroban-Native
Built for Stellar Soroban 25. WASM contract + reqwest off-chain. No bridges.
Operator
Plug in your stack.
oracle-watch dispatches the same alert to every configured sink. Click a sink — see exactly how the alert lands there.
Live on Stellar
Proven on-chain.
Three contracts deployed. 17 oracle-watch attestations. The first adversarial replay rejected at the protocol layer — every hash public and verifiable.
Deployed Contracts
Trust
Honest about what we are.
And what we are not.
safe-oracle has been subjected to an internal adversarial replay review across 20 attack scenarios — deviation, staleness, cross-source, liquidity-floor, and circuit-breaker bypass. No critical or high findings remain open, and the Layer 1 defaults are backtested against $244M of real oracle exploits — 3 of 3 in scope caught.
This is not a third-party audit. The methodology, the findings, and the patches are public in the repository. External audit is recommended before mainnet deployment with material funds.
And on trust: Layer 1 is fully trustless — pure on-chain Reflector math. Layer 2 is opt-in (off by default) precisely because it introduces a second trust vector: the off-chain attesters that sign liquidity snapshots. We won't pretend that cost away.