Skip to content

fix: sign prices with minimum observation time instead of signing time - #1353

Merged
SteffQing merged 1 commit into
SO4-Markets:mainfrom
ayobami-dale:fix/signed-price-observation-time
Oct 21, 2026
Merged

SteffQing merged 1 commit into
SO4-Markets:mainfrom
ayobami-dale:fix/signed-price-observation-time

Conversation

@ayobami-dale

Copy link
Copy Markdown
Contributor

Problem

The signed price timestamp was set to the signing time instead of the observation time from the price sources. This caused stale prices (up to 60 seconds old for Pyth) to be attested as current, defeating the purpose of the on-chain freshness check.

closes #1258

Solution

  • Added PriceWithTimestamp struct in pyth.rs to return both price and observation time from validation
  • Modified validate_pyth_price() to return PriceWithTimestamp instead of just the price value
  • Extended AggregatedPrice struct with min_observation_time field
  • Updated aggregate_prices() to accept observation times and compute the minimum from all sources used
  • Modified price fetching to track observation times:
    • Pyth: use publish_time from the validated price
    • Binance/Coinbase: use fetch time (current timestamp)
    • Fixed: use fetch time
  • Changed signed_cached_price() to sign with min_observation_time instead of current_timestamp_secs()

Verification

  • All unit tests updated to pass observation times to aggregate_prices()
  • Pyth validation tests updated to verify both price and observation_time are returned correctly
  • Staleness measurement now correctly uses observation time across all sources

@drips-wave

drips-wave Bot commented Oct 21, 2026

Copy link
Copy Markdown

@ayobami-dale Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

@SteffQing
SteffQing merged commit ff4e662 into SO4-Markets:main Oct 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

The signed price timestamp is the signing time, not the observation time, so a nearly stale Pyth price is attested as current

2 participants