Eight lines. Five guards. Zero exploits.
Trust the oracle.Verify the integrator.
Five mathematically-verified guardrails between your protocol and the next oracle manipulation attack.
use safe_oracle::{lastprice, SafeOracleConfig}; let price = lastprice( &env, &asset, &reflector, ®istry, &SafeOracleConfig::default(),)?;// 5 guards validated before this line.The Attack
$10.2Mdrained.
On February 22, 2026, an attacker manipulated a thin SDEX market with a single $5 trade to inflate collateral valuation on a Stellar lending protocol. They walked away with $10.2 million.
Reflector worked. Stellar worked. Blend V2 worked. The oracle reported the price it observed. The protocol trusted it.
The gap was integrator-side. safe-oracle closes that gap.
Sources: Rekt News · Halborn analysis · Script3 official statement
The Solution
Five guards.
Defense in depth.
Each guardrail closes a specific attack vector observed in real DeFi exploits. Mathematically validated, empirically tested.
How It Works
Five steps. One result.
Reflector Call
Your contract calls safe_oracle::lastprice() instead of Reflector directly.
Layer 1 — Oracle Checks
Deviation, staleness and cross-source disagreement validated against feed mechanics.
Layer 2 — Market Checks
SDEX 30-minute volume and unique-trader count validated against on-chain liquidity.
Circuit Breaker
Auto-halt after the first violation. Governance manual override available.
Result
Validated price returned — or Err with the specific violation type.
Architecture
Purely defensive.
Run a scenario and watch a borrow request flow through five guards — validated before it ever reaches your business logic.
Mechanism
Mathematically validated.
Every threshold below is calibrated for production deployment. Each is configurable per-integrator. Defaults reflect mainnet-grade security margins observed against real attack patterns.
Infrastructure
Modular by design.
Six independent components. Adopt the whole stack or only the guard you need — each is a clean, isolated boundary.
Layer 1 Guardrails
Deviation, staleness, cross-source. Validates oracle output before it reaches your logic.
Layer 2 Guardrails
Liquidity volume + thin sampling. Validates market microstructure on-chain.
Circuit Breaker
Auto-halt on first violation. Per-asset isolation. Manual governance override.
Liquidity Registry
Signed snapshots from off-chain attesters. Authoritative source for Layer 2 checks.
oracle-watch
Rust service. Monitors SDEX, signs snapshots, dispatches Slack / PagerDuty / webhook alerts.
Soroban-Native
Built for Stellar Soroban 25. WASM contract + reqwest off-chain. No bridges.
Operator
Plug in your stack.
oracle-watch dispatches the same alert to every configured sink. Add a webhook URL, deploy. Five shipped — more easily added.
Discord
Incoming webhook to any channel. Bold, alert-prefixed body.
Telegram
Bot sendMessage to a channel or group. Plain-text body.
Slack
Block Kit message — header + code-blocked body, amber accent.
PagerDuty
Events API v2 incident. Dedup-key hash collapses repeats.
Generic
POST { message, source } JSON to any URL. Custom headers.
Custom sink
Implement WebhookSink (kind() + send()), register in build_sinks().
Live on Stellar
Proven on-chain.
Three contracts deployed. 17 oracle-watch attestations. The first adversarial replay rejected at the protocol layer — every hash public and verifiable.
Deployed Contracts
Trust
Engineering metadata.
Live, verifiable, and current. No badges to take on faith — every value links to its source.