Where the Price Comes From

We just watched Maya trade at a firm price and her eTSLA appear - but that price had to come from somewhere honest before anyone would commit to it. Let's meet the part of the system that decides what Tesla is worth: the Oracle.

The problem with "just check a website"

Maya's eTSLA is supposed to track the real Tesla share price. So the protocol needs to know that price - constantly, and in a way it can trust.

The naive answer is "look it up." But a blockchain can't browse, and even if it could - which website? What if it's down, lagging by a minute, glitching, or simply lying? A protocol that holds real collateral can't stake its solvency on a feed it can't verify. If the price is wrong, every trade, every safety check, and every payout built on it is wrong too.

So Own treats the price like evidence. It needs to be fresh (reflecting now, not an hour ago), honest (produced carefully from real market data), and tamper-proof (provably untouched between the price-teller and the contract). And one rule is absolute: the protocol never values anything off onchain trading pools - prices that can be pushed around with a big enough trade. Valuation always comes from the outside world, signed.

The price-teller: gather, agree, sign

The Oracle service runs offchain. It gathers each asset's price from real market data, converts everything to US dollars, discards anything stale or suspicious, and settles on one number it would stake the protocol on.

Then comes the part the contracts care about: it wraps that number in a signed price attestation - a cryptographic stamp, made with a private key only the authorized signer holds, sealing together the asset, the price, and the exact moment. Anyone can check the stamp; nobody can forge it or alter the number underneath without breaking it.

Onchain, a verifier contract checks every incoming attestation before the protocol will touch it:

The signature must be valid and come from a signer on the approved list. A compromised signer can be removed instantly.
The price must be fresh. Older than the allowed window, and it's rejected.
Timestamps only move forward. An older price can never overwrite a newer one.
It can't jump absurdly. Each new price is compared with the last accepted one; a move beyond the allowed deviation band is refused. So even a stolen signing key can't mark Tesla at one dollar - each step is fenced to a small move from the last good price.
It's bound to this protocol on this chain. A price signed for Own can't be lifted and replayed elsewhere.

   real market data ─► Oracle service ─► signed attestation
                                              │
                                              ▼
                                   onchain verifier checks:
                                   signer ✓  fresh ✓  forward ✓
                                   within deviation band ✓
                                              │
                                              ▼
                                        ONE trusted price

Two oracles per asset, not one

Own doesn't lean on a single price machine. Each asset is configured with a primary and a secondary oracle, and the admin can swap between them:

The in-house signed oracle - the attestation flow above, run by the protocol's own price service. Best for assets that need custom sourcing.
Pyth Network - a large, independent oracle network used across DeFi. Own reads Pyth's feeds through its own gate: prices are normalized to a standard format, rejected when Pyth's own confidence interval is too wide, and rejected when too old. For stocks, Pyth even provides separate feeds for regular, pre-market, post-market, and overnight sessions.

The whole oracle layer sits behind a single swappable address in the protocol's registry - so if better price infrastructure emerges (Chainlink, a ZK oracle), the protocol can migrate to it without touching anything else.

Where the signed price goes

That verified price feeds two things you've already met, plus one you haven't:

The maker's quotes. The dealer prices its firm quotes off the oracle price, and the settle band from Chapter 4 keeps every settlement near it.
The marks. The protocol keeps a working price for each asset - its mark - used for all risk accounting: the solvency check on every mint, the value of the reserves, the caps. Marks are refreshed from the oracle by the Keeper (Chapter 13), and a mint is only allowed while the asset's mark is fresh.
The exits. When we get to the guarantees in Chapter 8, you'll see that a holder can force a redemption at the oracle price - so the same signed evidence that prices Maya's mint also stands behind her way out.

The Oracle, importantly, holds no power of its own. It can't move money or touch a vault. All it does is tell the truth about price, provably. Everything else is built to check it.

What just happened

The protocol needs Tesla's real price constantly, and it treats that price as evidence: fresh, honest, tamper-proof - and never taken from onchain trading pools.
An offchain Oracle service produces one careful number and wraps it in a signed price attestation; an onchain verifier checks the signer, the freshness, forward-only timestamps, and a deviation band before accepting it.
Even a leaked signing key is fenced in: it can only nudge the price within the band, only forward in time, and it can be removed instantly.
Each asset has a primary and secondary oracle - the in-house signed feed and Pyth Network - swappable by the admin, with the whole layer behind one upgradable address.
The verified price becomes the makers' quote basis, the protocol's marks for risk checks, and - later - the price a holder can force an exit at.

5. Where the Price Comes From