Price Oracle

Every loan on Libre depends on one number: the price of Bitcoin. It decides how much you can borrow, when a position enters the warning zone, and when liquidation can occur. Because so much rides on it, Libre prices Bitcoin with a decentralized, multi-feeder oracle rather than a single source.

How it works

1. Independent feeders report prices. Several authorized feeders — run by Libre block producers — each publish a BTC/USD price on-chain every 15–30 seconds. Each feeder sources its price from a different data provider, so the oracle never relies on any single exchange or aggregator. Only one report per feeder counts in a round, and a report older than 60 seconds is ignored.

2. A round needs at least 3 feeders. With fewer than three usable reports the oracle publishes nothing and the previous price stands.

3. Feeders must agree within 10%. The contract measures the spread across the round — highest report minus lowest, over their average. If that spread exceeds 10%, the entire round is skipped and the last good price is kept. Note what this is not: individual outliers are not filtered out. One disagreeing feeder does not get dropped; it either keeps the round inside the 10% band, or it invalidates the round for everyone.

4. The published price is the average of that round's reports. Not the median — the arithmetic mean of the reports that passed the checks above.

5. Confidence is published. Alongside the price, the oracle records a confidence score (1 − spread) and the deviation between feeders, so the quality of each price is transparent and verifiable on-chain.

Freshness guarantee

Each price carries a timestamp and is only valid for 5 minutes.

The lending contract will not act on a stale price. If the feed stops updating — because feeders go offline or the network is disrupted — loans are not liquidated using an old number. Liquidations simply pause until a fresh, valid price is available again. Borrowers are never liquidated on data the protocol can't trust.

Why not just use an exchange price?

An exchange price is one company's number, reported off-chain, that nobody on Libre can verify after the fact. The oracle's price is published on-chain by several independent parties, and every individual report stays readable forever.

This is the price the lending contract uses, so it is the only one that decides whether a loan is liquidated. Other price feeds exist around Libre's infrastructure — dashboards and charts may quote an exchange — but those are reference numbers. For anything involving collateral, LTV or liquidation, the oracle contract is the authoritative source.

Why this matters

• No single point of failure. Pricing doesn't depend on one company or one feed. A faulty or offline feeder doesn't stop the oracle, as long as three others are still reporting.

• Source diversity. Because each feeder pulls from a different price API, an outage or bad number at any one data provider is visible as disagreement between feeders rather than silently becoming the price.

• Fail-safe by design. Every failure mode — too few feeders, feeders disagreeing, a stale feed — results in the protocol doing nothing and keeping the last good price, rather than acting on data it can't trust. Liquidations pause; they don't fire on bad input.

• Fully transparent. The current price, confidence, deviation, the list of authorized feeders, and every individual report are all readable on-chain, so the aggregation can be recomputed by anyone.

What the aggregation does not do

Because the published price is an average, a single feeder does influence it. A feeder reporting a price that is wrong by x moves the published price by roughly x ÷ (number of feeders in the round) — so with four feeders, a report off by 8% (inside the spread limit) shifts the price about 2%. The 10% spread gate bounds how far this can go before the round is thrown out entirely; it does not eliminate the influence.

In other words, the design's guarantee is "a bad feeder cannot move the price far, and a badly disagreeing set of feeders moves it not at all" — not "a bad feeder cannot move the price." Corrupting the price meaningfully requires corrupting several feeders in the same direction at once, and keeping them inside 10% of each other while doing it.

Reading it on-chain

The aggregated price lives in the aggfeeds table of the oracle contract, and the authorized feeders are listed in its feeders table. The lending contract reads aggfeeds directly when evaluating loan health, applying the 5-minute freshness check before using any value.

Verify it yourself: query the oracle contract's aggfeeds table on any Libre RPC node to see the live BTC/USD price, its confidence score, and the timestamp of the last update.