> For the complete documentation index, see [llms.txt](https://docs.libre.org/libre-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.libre.org/libre-docs/understanding-the-platform/mechanics/price-oracle.md).

# Price Oracle

Every loan on Libre depends on one number: the price of Bitcoin. It decides how much you can borrow, when a position enters the warning zone, and when liquidation can occur. Because so much rides on it, Libre prices Bitcoin with a **decentralized, multi-feeder oracle** rather than a single source.

## How it works

1. **Independent feeders report prices.** Several authorized feeders — run by Libre block producers — each publish a BTC/USD price on-chain every **15–30 seconds**. Each feeder sources its price from a **different data provider**, so the oracle never relies on any single exchange or aggregator. Only one report per feeder counts in a round, and a report older than **60 seconds** is ignored.
2. **A round needs at least 3 feeders.** With fewer than three usable reports the oracle publishes nothing and the previous price stands.
3. **Feeders must agree within 10%.** The contract measures the spread across the round — highest report minus lowest, over their average. If that spread exceeds **10%**, the entire round is skipped and the last good price is kept. Note what this is *not*: individual outliers are not filtered out. One disagreeing feeder does not get dropped; it either keeps the round inside the 10% band, or it invalidates the round for everyone.
4. **The published price is the average of that round's reports.** Not the median — the arithmetic mean of the reports that passed the checks above.
5. **Confidence is published.** Alongside the price, the oracle records a **confidence score** (`1 − spread`) and the **deviation** between feeders, so the quality of each price is transparent and verifiable on-chain.

## Freshness guarantee

Each price carries a timestamp and is only valid for **5 minutes**.

The lending contract **will not act on a stale price**. If the feed stops updating — because feeders go offline or the network is disrupted — loans are **not** liquidated using an old number. Liquidations simply **pause** until a fresh, valid price is available again. Borrowers are never liquidated on data the protocol can't trust.

## Why not just use an exchange price?

An exchange price is one company's number, reported off-chain, that nobody on Libre can verify after the fact. The oracle's price is published on-chain by several independent parties, and every individual report stays readable forever.

This is the price the lending contract uses, so it is the only one that decides whether a loan is liquidated. Other price feeds exist around Libre's infrastructure — dashboards and charts may quote an exchange — but those are reference numbers. **For anything involving collateral, LTV or liquidation, the `oracle` contract is the authoritative source.**

## Why this matters

* **No single point of failure.** Pricing doesn't depend on one company or one feed. A faulty or offline feeder doesn't stop the oracle, as long as three others are still reporting.
* **Source diversity.** Because each feeder pulls from a different price API, an outage or bad number at any one data provider is visible as disagreement between feeders rather than silently becoming the price.
* **Fail-safe by design.** Every failure mode — too few feeders, feeders disagreeing, a stale feed — results in the protocol doing *nothing* and keeping the last good price, rather than acting on data it can't trust. Liquidations pause; they don't fire on bad input.
* **Fully transparent.** The current price, confidence, deviation, the list of authorized feeders, and every individual report are all readable on-chain, so the aggregation can be recomputed by anyone.

### What the aggregation does not do

Because the published price is an **average**, a single feeder does influence it. A feeder reporting a price that is wrong by *x* moves the published price by roughly *x ÷ (number of feeders in the round)* — so with four feeders, a report off by 8% (inside the spread limit) shifts the price about 2%. The 10% spread gate bounds how far this can go before the round is thrown out entirely; it does not eliminate the influence.

In other words, the design's guarantee is **"a bad feeder cannot move the price far, and a badly disagreeing set of feeders moves it not at all"** — not "a bad feeder cannot move the price." Corrupting the price meaningfully requires corrupting several feeders in the same direction at once, and keeping them inside 10% of each other while doing it.

## Reading it on-chain

The aggregated price lives in the `aggfeeds` table of the `oracle` contract, and the authorized feeders are listed in its `feeders` table. The lending contract reads `aggfeeds` directly when evaluating loan health, applying the 5-minute freshness check before using any value.

> **Verify it yourself:** query the `oracle` contract's `aggfeeds` table on any Libre RPC node to see the live BTC/USD price, its confidence score, and the timestamp of the last update.