Pricing: harden oracle acceptance path against wrong-route mispricings (GHO/sUSD/HAI + value-imbalance guard)

[FonsSicca]

Source: data-quality audit of deployment 8fcf9a8 (2026-07-07). Full findings: Notion audit.

What to build

Harden the price-oracle acceptance path so it rejects consistently-wrong routes, not only sudden jumps. Today the oracle accepts a fresh quote whenever it is internally consistent, with no cross-check against liquidity depth or plausible magnitude. The existing guards (spike #668, absolute ceiling #788, pool-implied re-anchor #784/#785) reject jumps and out-of-band values, not routes that are stable-but-wrong. The result is roughly $1.2M of live TVL distortion across three whitelisted, trusted tokens, plus five small tokens.

Live majors:

• GHO on Ink +46.5%: stored $1.4625 against pool-implied $0.999 (Dune $0.9985), after a spike to $141.47 on 07-03. ~+$349k on the main pool.
• sUSD on Optimism: stores $0.302 while its only indexed market is drained to $0.0000235 and Dune reports $0.59 to $0.63 elsewhere. ~$760k phantom TVL. sUSD is itself a configured price connector, which raises blast radius.
• HAI on Optimism -58%: stored $0.553 against $1.31 execution-verified across two pools. ~$102k under-count.

Small (same oracle class, ≤$10k each): HOP/OP 1.71x, WELL/OP 1.98x, xSN50/Base +42%, USDC.e/Metal -6.6%, USD+/OP 0.51x.

Proposed mechanism: adopt a value-imbalance ceiling on candidate pricing pools, per Envio's uniswap-v4-indexer PR (enviodev/uniswap-v4-indexer#57). Reject a pool's candidate price when the priced side's implied value exceeds N times the trusted/whitelisted side's value (Envio uses 1000x). This is a first-principles arbitrage invariant complementary to our existing guards, which bound magnitude and re-anchor but never compare the two sides of the pricing pool against each other. Also consider a liquidity-depth or plausible-magnitude cross-check at the acceptance path.

Root cause: src/PriceOracle.ts, the refreshTokenPrice acceptance path. The spike and anchor guards at lines 354-478 reject jumps only.

Acceptance criteria

• GHO/Ink, sUSD/OP, and HAI/OP resolve to within a few percent of Dune / pool-implied after reindex.
• The five small tokens resolve or are correctly gated.
• A value-imbalance guard rejects candidate prices whose priced side exceeds the trusted side by more than a configured ratio, with tests covering poison pools, balanced pools, and boundary behavior.
• No regression on the 36 majors (already within ±3% of Dune).

Reference

Envio approach: enviodev/uniswap-v4-indexer#57

Blocked by

None — can start immediately.