Spot Oracle


The spot oracle, in contrast to the reserve oracle, reflects the β€˜market price’ of the asset, the price at which the asset trades at in external markets. This oracle is used by the IonPool when opening, altering, or closing debt positions.

It is necessary for the IonPool to operate on market price instead of reserve price like the Liquidation module since operating on the reserve price would allow the pool to be arbitraged against.

Design Decisions


The Spot Oracle does not use any explicit bounding. For the Spot Oracle, an upward bend of the price is dangerous while a downwards bend has minimal implications on protocol safety. A downwards bend is still unideal, but there isn’t much economic incentive to perform it. An upward bend could lead to protocol insolvency by unintentionally allowing the creation of under-collateralized debt.

In most cases, we expect that the price in the spot oracle will be lower than the price in the reserve oracle since reserve oracle prices are based on beacon chain balances and secondary markets will most likely price in the illiquid nature of the true exchange rate. However, if for some reason market price were to rise above this true exchange rate, it wouldn’t make sense for the core to operate off of this unbacked price. So the spot oracle will min() the market price and the price provided by the reserve oracle to ensure that IonPool is not operating on a price that is unbacked by beacon chain reserves. This also provides an implicit upper bound on-the-spot oracle price (which is the direction of manipulation we most want to protect against!)

RedStone Oracles

RedStone Oracles are used to get the market price and calculate the spot value of collateral deposited to borrow assets at Ion Protocol.

RedStone is a modular Oracle offering Pull and Push models on Ethereum and across EVM chains. They offer versatile LSTs and LRTs data feeds, which enables Ion Protocol to easily scale its support of these collateral types.

RedStone Docs:

RedStone Twitter:

All price feed addresses for assets supported by Ion Protocol can be found here:

Security Concerns

If the market price were to diverge downwards significantly from the reserve oracle price, upward price manipulation could become possible. This could happen as a result of a liquidity crunch of collateral despite a lack of slashings.

Eg: Market price of collateral-A is 0.5eth and reserve price is 1 eth. If the LTV is 90%, then if someone could manipulate the price upwards, the protocol would be used as an exit vehicle.

In the case of an oracle failure/DOS (such as denial through a chainlink multisig), the protocol would come to a halt. Any reverts in the SpotOracle would prevent any protocol action from going through. This is expected and desirable.

This acts as an automatic pause, allowing the team to assess the situation, deploy a new, fixed SpotOracle, and update the spot address in the IonPool.For ETHx and swETH, the beacon chain loss will not have a direct impact on the getSpot at all as their prices are sourced from RedStone and Uniswap TWAP.

For stETH, the beacon chain loss will have a direct impact on the getSpot. When there’s a beacon chain loss, the wstETH exchange rate will directly read from the stETH CL_BALANCE variable and report a lower exchange rate.

The stETH spot is calculated using the wstETH to stETH conversion on the wstETH contract and the stETH to ETH conversion through chainlink market price. The wstETH to stETH conversion will be directly affected while the chainlink market price is not directly impacted. So technically the stETH spot price is not perfectly decoupled from a slashing event in terms of direct causality. The stETH spot price is a combination of the wstETH to stETH exchangeRate going down as well as the market price movements in external markets observed by Chainlink.

Last updated