> For the complete documentation index, see [llms.txt](https://candora.gitbook.io/whitepaper/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://candora.gitbook.io/whitepaper/candora-grid/oracle.md).

# Oracle

### Pricing Integrity, Market Consensus, and Reference-State System

Candora Oracle is the pricing integrity and valuation layer of Candora Grid. It is responsible for constructing reference prices, validating market data sources, generating consensus pricing states, and supplying valuation data throughout the exchange infrastructure.

Oracle serves as the authoritative valuation layer of the Grid. Systems responsible for liquidation, collateral management, margin enforcement, reserve accounting, settlement validation, and market-state synchronization all depend on Oracle for consistent valuation. Unlike conventional pricing oracles that operate as passive aggregation services, Oracle functions as an active pricing-consensus system. Rather than simply relaying market prices, it evaluates source quality, liquidity conditions, execution consistency, and market reliability before publishing a valuation state consumed across the platform.

At a system level, Oracle constructs a reference pricing model:

```
P_ref(t) = f(P_external, P_execution, P_liquidity)
```

where valuation is derived from external pricing inputs, execution-derived information, and liquidity-aware pricing signals. The resulting pricing state is distributed throughout Candora Grid and serves as the common valuation framework used by downstream infrastructure domains.

### Valuation Coordination

Oracle coordinates valuation through a single canonical pricing state consumed across the platform. Orbit, Risk Engine, Vault, Pulse, and Connect all reference the same underlying valuation framework rather than maintaining independent pricing interpretations.

This shared model ensures that collateral valuation, liquidation calculations, reserve accounting, settlement valuation, and market-state propagation operate from a consistent reference state. By centralizing valuation authority, Oracle reduces pricing divergence during periods of elevated volatility and improves consistency across the broader exchange environment.

### System Boundary

Oracle defines valuation state, but it does not determine execution outcomes.

Its responsibilities include producing index prices, mark prices, reference prices, and collateral valuation inputs used throughout the Grid. Oracle does not match orders, determine execution priority, set execution prices, override completed trades, or independently modify market state. Orbit remains responsible for execution, while Oracle remains responsible for valuation integrity.

This separation ensures that pricing authority and execution authority remain independent while still operating from synchronized system state.

### Multi-Source Pricing Architecture

Oracle constructs valuation from multiple pricing inputs originating from both external and internal sources. These inputs may include external exchange feeds, institutional liquidity providers, Orbit execution telemetry, Pulse market-state metrics, Vault settlement signals, and Risk Engine liquidation activity.

Incoming information is normalized into a common pricing-event structure:

```
E_price = {source, symbol, price, weight, confidence, timestamp}
```

Before contributing to valuation, each source is continuously evaluated according to liquidity depth, latency consistency, spread stability, execution correlation, historical reliability, and pricing deviation behavior. Not all inputs are treated equally. Oracle applies deterministic credibility and weighting rules so that valuation reflects source quality rather than raw data volume.

This architecture allows Oracle to adapt to changing market conditions while maintaining a stable and reproducible valuation process.

### Source Hierarchy and Fallback Behavior

External executable pricing serves as the primary pricing anchor under normal operating conditions. Internal signals from Orbit, Risk Engine, and Vault act primarily as validation inputs and secondary weighting signals.

To preserve pricing integrity, external markets remain the dominant reference source whenever reliable pricing is available. Internal signals remain bounded, degraded sources may be down-weighted or excluded, and predefined fallback rules govern source-failure scenarios.

When external markets become fragmented or unreliable, Oracle may shift weighting toward execution-consistent and liquidity-supported pricing signals according to established policies. This allows valuation continuity while avoiding uncontrolled internal repricing.

### Consensus Pricing Engine

Oracle generates consensus valuation through a structured aggregation process. Pricing inputs are normalized, validated, weighted, aggregated, and then published as a unified valuation state.

For each instrument:

```
W = {(P_i, w_i)}
```

where `P_i` represents a candidate price and `w_i` represents its assigned weight.

Oracle computes:

```
P_index = Aggregate(W)
```

The aggregation process is designed to remain stable under fragmented market conditions while remaining responsive to genuine price discovery.

The resulting valuation framework continuously produces index prices, mark prices, liquidity-adjusted valuations, collateral reference prices, and fair-value estimates used throughout Candora Grid.

### Outlier Rejection and Market Integrity

Oracle continuously evaluates incoming pricing data for abnormal behavior and source degradation.

Outlier detection follows:

```
|P_i - P_index| > kσ
```

where `σ` represents observed price deviation and `k` represents an adaptive tolerance factor.

Sources exhibiting abnormal divergence may be down-weighted, excluded, or quarantined according to predefined validation policies. The objective is to reduce the influence of thin-market distortions, feed failures, pricing anomalies, cross-venue dislocations, and malicious data injection while preserving responsiveness to legitimate market movement.

Oracle may additionally maintain historical source-quality metrics to support long-term reliability assessment and source validation.

### Execution and Solvency Synchronization

Oracle acts as the valuation bridge between execution systems, solvency systems, and settlement systems.

Orbit consumes Oracle pricing for execution validation, market-integrity checks, and reference-price verification. Risk Engine consumes Oracle pricing for collateral valuation, margin computation, liquidation evaluation, and leverage management. Vault consumes Oracle pricing for reserve valuation, settlement accounting, and collateral tracking.

Because all critical infrastructure domains operate from the same valuation framework, execution, solvency, and settlement processes remain synchronized even during periods of market stress.

### Recovery and Valuation Reconstruction

Oracle maintains ordered valuation-event streams and synchronized checkpoints that allow deterministic recovery of pricing state.

Recovery follows a structured process:

1. Restore a valuation checkpoint.
2. Replay subsequent pricing events.
3. Reconstruct reference state.
4. Resume valuation publication.

Formally:

```
P_recovered = P_snapshot + ∑ ΔEvents
```

This allows valuation state to remain consistent across recovery, replay, simulation, and distributed restoration environments.

Because Oracle derives valuation from deterministic event streams, reconstructed state remains consistent with original system behavior.

### System Role Summary

Candora Oracle serves as the pricing integrity layer, reference-price authority, market-consensus engine, valuation coordination system, mark-price provider, collateral valuation framework, and pricing-reconstruction authority of Candora Grid.

All reference pricing, valuation consistency, and market-consensus state within Candora Grid ultimately originate from Oracle, making Oracle the foundational valuation layer of the exchange infrastructure.