Oracle Market Study
Key Concepts
| Term | Definition |
|---|---|
| Oracle | An off-chain service that writes real-world data (prices) into on-chain accounts so smart contracts can read it |
| VAA (Verified Action Approval) | A price update signed cryptographically by the Pyth/Wormhole guardian network. Contains the price, confidence interval, and publish timestamp. The smart contract verifies the signature before trusting the value, prevents anyone from submitting a fabricated price |
| Pull oracle | The user fetches the latest VAA off-chain (from Hermes) and includes it in their transaction. The smart contract processes it on-chain. No background process needed to keep prices updated |
| Push oracle | An external process periodically writes the price to an on-chain account proactively. The smart contract reads the account directly. Simpler to integrate but requires someone to pay for continuous updates |
| Hermes | Pyth's off-chain API that serves the latest signed VAAs. Acts as a bridge between Pythnet (where prices are published) and any chain where they need to be submitted |
| Confidence interval (conf) | A ±σ value published alongside each price, indicating how spread the prices are across data providers. A high conf means high uncertainty - smart contracts use it to reject updates during volatile periods |
| CPI (Cross-Program Invocation) | A Solana mechanism that allows one smart contract to call another. Used to submit the VAA to the Pyth receiver program from within the trading contract |
| Mark price | The price used by the protocol for PnL, margin, and liquidations - derived from the oracle price |
| Oracle price | The raw oracle price of the underlying spot asset, used as the reference for funding rate calculations |
1. Summary
In a fully onchain perpetual futures protocol, smart contracts cannot make HTTP calls or fetch external data - they can only read Solana accounts. Oracles solve this by writing real-world prices into on-chain accounts that the smart contract reads via CPI.
For markets already covered by major oracle networks (SOL, BTC, ETH), price feeds already exist and are free to consume. In Pyth's pull model, the user submitting a trade includes the signed price attestation in their own transaction, so the protocol pays no additional cost beyond normal Solana transaction fees. Costs only arise if custom feeds are needed for unlisted assets, or for production-grade Hermes API access.
2. Role of Oracles in a Perps CLOB
| Use | Description | Frequency |
|---|---|---|
| Mark Price | Price used for unrealized PnL and margin calculations | Per block (embedded in each user tx) |
| Oracle Price | Reference spot price of the underlying asset | Per block |
| Funding Rate | Computed as (mark - oracle) / oracle, paid between longs and shorts | Periodic (~1h) |
| Liquidation | Triggered when margin falls below maintenance threshold at mark price | Continuous |
3. Provider Comparison
| Feature | Pyth | Switchboard | Chainlink |
|---|---|---|---|
| Model | Pull | Push + Pull | Push (OCR) |
| Latency | <400ms | ~1s | ~1-2s |
| Solana-native | Yes | Yes | Limited |
| Cost for listed feeds | Free (data) | Free (data) | LINK / sponsor |
| Confidence interval | Yes (±σ) | Not native | No |
| Available feeds | 500+ | 300+ | <50 on Solana |
| Used by (Solana DeFi) | Drift, Mango, Zeta, Phoenix | Marginfi, Kamino | Very few |
Pyth Network
- Model: Pull oracle. Prices are published by institutional data providers (Jane Street, Jump Trading, etc.) to Pythnet - a dedicated appchain. Signed attestations (VAAs) are served off-chain via the Hermes API and submitted on-chain by users as part of their own transactions via CPI. The protocol pays nothing extra.
- Price data: Free. Pyth does not charge for the price feeds themselves.
- Hermes API access: Follows the same model as a Solana RPC provider. A public instance (
hermes.pyth.network) is available for development at no cost. Production use requires a node provider with an API key (Triton, P2P, extrnode, Liquify), billed similarly to RPC plans. - Confidence interval: Every price update includes a
conffield (±σ in USD), usable to widen liquidation bands during high volatility or to reject updates where uncertainty exceeds a defined threshold. - Staleness: Each update includes a
publish_timeUnix timestamp. Smart contracts must validate that the price is not older than a configuredmax_age(e.g. 60 seconds). - Relevant feeds for Artifi: SOL/USD, BTC/USD, ETH/USD - all already published and active.
- Upcoming: Pyth Core contract addresses are being upgraded on 31 July 2026. New integrations should use the upgraded addresses; existing ones will be migrated automatically by the DAO.
Switchboard
- Model: Push (aggregator jobs - oracle nodes aggregate on a schedule) and Pull (on-demand - users request a price update and pay the tx fee). The on-demand model mirrors Pyth's pull approach.
- Existing feeds: Free to consume. Covers most major assets.
- Custom feeds: Can create aggregator feeds for any asset or data source. Requires SOL to fund an oracle lease that pays node operators (~0.1 SOL/month per high-frequency feed).
- Use case for Artifi: Primary fallback if Pyth is unavailable; custom feeds for unlisted assets if needed.
Chainlink
- Model: Push via Off-Chain Reporting (OCR). A committee of oracle nodes reports prices off-chain and submits a signed consensus update on-chain on a schedule.
- Solana presence: Limited - fewer available feeds, less mature tooling compared to EVM chains where Chainlink originated.
- Cost: Requires LINK tokens (wrapped on Solana) or a sponsorship arrangement. Estimated at $50-200/month per feed.
- Verdict: Not suitable for a Solana-native protocol. Higher cost, fewer feeds, no latency advantage over Pyth.
4. Integration in Smart Contracts
The Pyth pull model requires the user to fetch the latest signed price attestation (VAA) off-chain and include it as part of the Solana transaction. The smart contract receives the VAA, writes the price to a temporary on-chain account via CPI, then reads that account to validate and use the price.
Required safety checks in the smart contract:
| Check | Why |
|---|---|
Price age < max_age (e.g. 60s) | Reject stale prices |
conf / price < max_conf_ratio (e.g. 5%) | Reject during extreme market uncertainty |
| Fallback to Switchboard if Pyth unavailable | Resilience against oracle outages |
5. Real-time Price Flow in the App
The app never connects to Hermes directly. The API server maintains a single persistent WebSocket connection to Hermes and fans out price updates to all connected clients. This means 100 users cost the same as 1 user in terms of Hermes load.
Flow:
- API server opens one WebSocket stream to
hermes.pyth.networkon startup, subscribing to all active feed IDs (SOL, BTC, ETH). - Hermes pushes a price update.
- The API server parses each update and broadcasts it via the
market:{symbol}WebSocket channel. - Every connected client subscribed to that channel receives the update immediately.
- The app displays the new price, no additional requests, no polling.
Why the API server and not the browser:
The public Hermes endpoint enforces a rate limit of 10 requests per 10 seconds per IP. Clients exceeding this receive a 429 for the subsequent 60 seconds. If each browser fetched VAAs directly, 10 concurrent users placing orders simultaneously would already hit the limit. The API server acts as a single consumer. One IP, one stream, N clients out.
Note: the WebSocket stream (used for price display) counts as one persistent connection, not as repeated requests, it is not subject to the same rate limit. The limit primarily affects HTTP VAA fetches (one per order placed).
Hermes access by environment:
| Environment | Hermes endpoint | Cost |
|---|---|---|
| Development / Devnet | https://hermes.pyth.network (public) | $0 |
| Production (Mainnet) | Node provider with API key | Provider plan |
Official node providers: Triton, P2P, extrnode, Liquify.
6. Integration Points
Three distinct integration points in the Artifi stack:
| Integration point | Where it runs | What it does |
|---|---|---|
| Price feed for UI | API server | Subscribes to Hermes WebSocket → broadcasts parsed prices via market:{symbol} channel |
| Place order | API server + browser wallet | API fetches VAA + builds unsigned tx → browser wallet signs → submits to Solana RPC |
| Liquidation | Keeper bot | Polls positions → detects undercollateralized → fetches VAA → signs and submits liquidation tx |
Liquidation keeper:
A continuously running off-chain process that monitors all open positions, identifies those undercollateralized at the current mark price, and submits liquidation transactions. The keeper holds its own wallet and signs independently. Liquidation is permissionless.
6. Cost Breakdown
For Artifi, oracle costs are effectively zero, both for the prototype and in production for the protocol itself.
| Component | Who pays | Cost | When does it change |
|---|---|---|---|
| Pyth price feed (data) | Nobody | $0 - always free | Never |
| VAA submission on-chain | User (in their own trade tx) | ~0.000005 SOL per tx | Never - user always pays this as part of normal tx fees |
| Hermes API (streaming + VAA fetch) | Protocol | $0 - public endpoint | Only when user volume hits rate limits (early-stage: never) |
| Hermes API at scale | Protocol | Provider plan (~$50-200/mo) | When the public endpoint becomes a bottleneck - not a prototype concern |
The only cost that ever falls on the protocol is the Hermes provider plan, and only at scale. Everything else is either free or paid by the user as part of their normal transaction.
7. Recommendation
| Priority | Provider | Reason |
|---|---|---|
| 1 - Primary | Pyth Network | Most widely used in Solana perps (Drift, Mango, Zeta), pull model means zero on-chain protocol cost, native confidence interval for risk management |
| 2 - Fallback | Switchboard (on-demand) | Fallback if Pyth unavailable; custom aggregator feeds for unlisted assets |
| - Skip | Chainlink | High cost, limited Solana coverage, no advantage over Pyth on Solana |