[VPD-893]: Add DeviationBoundedOracle Contracts by GitGuru7 · Pull Request #306 · VenusProtocol/oracle

GitGuru7 · 2026-03-31T16:32:57Z

Description

Adds DeviationBoundedOracle contract that wraps the Resilient Oracle and provides manipulation-resistant pricing for lending operations
Maintains a per-market rolling min/max price window and automatically activates protection mode when the spot price deviates significantly from the window bounds
In protection mode, collateral is valued at min(spot, windowMin) and debt at max(spot, windowMax), guarding against short-duration price manipulation on low-liquidity tokens
Supports configurable entry/exit thresholds with hysteresis and per-market cooldown periods
Adds IDeviationBoundedOracle interface

coderabbitai · 2026-03-31T16:33:04Z

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 034ec313-44e7-4e98-860b-da7d1d24f54d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch feat/vpd-893-bounded-price-oracle

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

…Solidity style

…ve events/errors to interface

Debugger022 · 2026-04-06T11:42:12Z

contracts/DeviationBoundedOracle.sol

+     */
+    constructor(ResilientOracleInterface _resilientOracle, address nativeMarketAddress, address vaiAddress) {
+        ensureNonzeroAddress(address(_resilientOracle));
+        ensureNonzeroAddress(nativeMarketAddress);


Suggested change

ensureNonzeroAddress(nativeMarketAddress);

ensureNonzeroAddress(nativeMarketAddress);

ensureNonzeroAddress(vaiAddress);

Debugger022 · 2026-04-06T12:45:21Z

contracts/DeviationBoundedOracle.sol

+        }
+        _expandPriceWindow(state, spot, asset);
+        _checkAndTriggerProtection(state, spot, asset);
+        (minPrice, maxPrice) = _resolveBoundedPrices(


state.minPrice, state.maxPrice, and state.isProtectedPriceActive are all re-read from storage here after _expandPriceWindow and _checkAndTriggerProtection have already loaded (and potentially written) them. That's up to 3 avoidable warm SLOADs on every call. Consider having _expandPriceWindow return (uint128 windowMin, uint128 windowMax) and _checkAndTriggerProtection return bool nowActive, then pass those locals in directly.

Debugger022 · 2026-04-06T12:57:44Z

contracts/DeviationBoundedOracle.sol

+        address asset = _getUnderlyingAsset(vToken);
+        MarketProtectionState storage state = assetProtectionConfig[asset];
+        uint256 spot = _fetchSpotPrice(asset);
+        if (!state.isBoundedPricingEnabled) {


If setTokenConfig was never called for the asset, state is zero-initialized so isBoundedPricingEnabled == false and this silently returns (spot, spot) with no protection — every other helper here uses _ensureInitialized and reverts. We should add _ensureInitialized(asset) at the top here as well.

_ensureEnabled is only called by helpers that operate on assets enabled for bounded pricing. Returning the spot price here is intentional, it prevents non-enabled assets from falling back to the resilient oracle, avoiding additional branching in the Comptroller.

Debugger022 · 2026-04-06T13:21:12Z

contracts/interfaces/IDeviationBoundedOracle.sol

+        /// @notice Timestamp of the last protection trigger — reset on every trigger
+        uint64 lastProtectionTriggeredAt;


_checkAndTriggerProtection early-returns when isProtectedPriceActive == true, so this timestamp is only ever set on the initial false→true transition — it's never refreshed for subsequent anomalies during the same protection cycle.

Yes, as per the design this should be updated on each call, but I was thinking the threshold breach itself might be sufficient.

I think it should be fine to rely on a fixed cooldown from when it was triggered, since additionally we also have a threshold based check. This avoids repeated updates on every call, keeping it open here.

Debugger022 · 2026-04-06T13:37:44Z

contracts/DeviationBoundedOracle.sol

+     * @custom:error PriceRangeNotConverged if window range is still above exit threshold
+     * @custom:event ProtectedPriceDisabled
+     */
+    function disableActiveProtection(address asset) external {


For address(0) or any uninitialized asset, state is the zero default with isProtectedPriceActive == false, so this reverts with ProtectedPriceInactive — a misleading error suggesting the asset is configured but inactive. Add ensureNonzeroAddress(asset) and use _ensureInitialized(asset) like the other governance functions, so callers get MarketNotInitialized instead.

Debugger022 · 2026-04-06T13:39:52Z

contracts/DeviationBoundedOracle.sol

+            revert ProtectedPriceActive(asset);
+        }
+
+        state.isBoundedPricingEnabled = enabled;


Calling with enabled equal to the current value still pays an SSTORE and emits a misleading BoundedPricingWhitelistUpdated event. Add if (state.isBoundedPricingEnabled == enabled) return; before the write.

Debugger022 · 2026-04-06T13:54:55Z

contracts/DeviationBoundedOracle.sol

+            revert ProtectedPriceActive(asset);
+        }
+
+        state.isBoundedPricingEnabled = enabled;


Re-enabling a previously disabled asset leaves the window state stale. If asset was disabled at spot=$15 with window ($13, $17) and re-enabled later at spot=$80, the next public call expands maxPrice to $80, fires the trigger ($80 > $13 * 1.1667), and returns collateral=$13 for an asset worth $80 — mass liquidations follow.

when flipping enabled false → true, we should re-seed minPrice = maxPrice = _fetchSpotPrice(asset).

GitGuru7 · 2026-04-08T06:22:27Z

@coderabbitai review

…eviationBoundedOracle

fred-venus · 2026-04-09T08:10:16Z

contracts/DeviationBoundedOracle.sol

+            minPrice: spotU128,
+            maxPrice: spotU128,
+            isProtectedPriceActive: false,
+            isBoundedPricingEnabled: true,


how about we have isBoundedPricingEnabled pass in as a param

Yes would be more flexible adde here: 58ce852

fred-venus · 2026-04-09T08:13:05Z

contracts/DeviationBoundedOracle.sol

+    function disableActiveProtection(address asset) external {
+        _checkAccessAllowed("disableActiveProtection(address)");
+        ensureNonzeroAddress(asset);
+        _ensureInitialized(asset);


MarketProtectionState storage state = _ensureInitialized(asset); ?

fred-venus · 2026-04-09T08:19:36Z

contracts/DeviationBoundedOracle.sol

+
+        MarketProtectionState storage state = _ensureInitialized(asset);
+
+        if (!enabled && state.isProtectedPriceActive) {


how about rename isProtectedPriceActive to currentlyUsingProtectedPrice etc..

fred-venus · 2026-04-09T08:42:52Z

contracts/DeviationBoundedOracle.sol

+     * @custom:event ProtectionInitialized
+     * @custom:event BoundedPricingWhitelistUpdated
+     */
+    function setTokenConfig(


ideally we should have batch version for the following setters as we might want to enable this for mostly all the assets

fred-venus · 2026-04-09T08:49:02Z

contracts/DeviationBoundedOracle.sol

+        if (rangeRatio >= state.resetThreshold) {
+            revert PriceRangeNotConverged(asset, rangeRatio, state.resetThreshold);
+        }
+


lastProtectionTriggeredAt = 0 ?

fred-venus · 2026-04-09T08:52:40Z

contracts/DeviationBoundedOracle.sol

+        uint256 spot,
+        address asset
+    ) internal returns (bool triggered) {
+        if (state.isProtectedPriceActive) return true;


Let's try not to early return here, as we need to update the lastProtectionTriggerAt, imagine that protectedPriceActive has already been set to true, and then the market is volatile and constantly exceeds the deviation threshold. In this case, we need to keep lastProtectionTriggerAt up to date as well. In the current implementation, this is always going to be the stale value.

fred-venus · 2026-04-09T09:02:26Z

contracts/DeviationBoundedOracle.sol

+    constructor(ResilientOracleInterface _resilientOracle, address nativeMarketAddress, address vaiAddress) {
+        ensureNonzeroAddress(address(_resilientOracle));
+        ensureNonzeroAddress(nativeMarketAddress);
+        ensureNonzeroAddress(vaiAddress);


do we have vai on on bsc chain ?

Yes, we do have it, there isn’t any market for it, just the token address. Still, I think it’s good to keep the bounded oracle consistent across all assets for overall oracle behavior.

…lds, and fix NatSpec

github-actions · 2026-04-10T12:11:13Z

Package	Line Rate	Branch Rate	Health
contracts	99%	89%	✔
contracts.interfaces	100%	100%	✔
contracts.lib	100%	100%	✔
contracts.oracles	83%	76%	✔
contracts.oracles.common	98%	93%	✔
Summary	93% (540 / 580)	85% (261 / 306)	✔

feat: add initial DeviationBoundedOracle contract implementation

16784b9

GitGuru7 added 4 commits April 1, 2026 20:42

refactor: (WIP) add improvements to DeviationBoundedOracle

cbf42d1

feat: add Claude workflow including rules and skills for testing and …

185175c

…Solidity style

refactor: improve code flow and structure, add dual-price API, and mo…

f2c4df5

…ve events/errors to interface

chore: minor cleanups

7a18054

Debugger022 reviewed Apr 6, 2026

View reviewed changes

feat: add tests

590fdf0

Debugger022 reviewed Apr 6, 2026

View reviewed changes

feat: deployment scripts and fork tests

5be0f8b

refactor: eliminate redundant storage reads and implicit returns in D…

1af785b

…eviationBoundedOracle

GitGuru7 marked this pull request as ready for review April 9, 2026 06:14

fred-venus reviewed Apr 9, 2026

View reviewed changes

feat: add setTokenConfigs batch function, rename protection state fie…

58ce852

…lds, and fix NatSpec

	ensureNonzeroAddress(nativeMarketAddress);
	ensureNonzeroAddress(nativeMarketAddress);
	ensureNonzeroAddress(vaiAddress);

		/// @notice Timestamp of the last protection trigger — reset on every trigger
		uint64 lastProtectionTriggeredAt;


		MarketProtectionState storage state = _ensureInitialized(asset);

		if (!enabled && state.isProtectedPriceActive) {

Conversation

GitGuru7 commented Mar 31, 2026

Description

Uh oh!

coderabbitai bot commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

GitGuru7 commented Apr 8, 2026

Uh oh!

fred-venus Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

fred-venus Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

GitGuru7 Apr 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Apr 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

coderabbitai bot commented Mar 31, 2026 •

edited

Loading

fred-venus Apr 9, 2026 •

edited

Loading

fred-venus Apr 9, 2026 •

edited

Loading

GitGuru7 Apr 10, 2026 •

edited

Loading