Verifiable Blockchain Oracles on Chronicle Protocol

Key Insights

• Chronicle Protocol secures +$5 billion and accounts for 16.8% of total value secured (TVS) among all oracle networks.
• Chronicle’s Schnorr multi-signature aggregation scheme enables multiple validators to be verified at a constant rate, given that the Schnorr scheme enables multiple parties to sign a single aggregated signature.
• In line with its mission, Chronicle has added features to its oracle dashboard that enable users to verify the data they observe in-browser. This separates Chronicle from other oracles, which do not feature this ability and inherently require trust from users.
• Chronicle Protocol evolved from the Oracle Core Unit at MakerDAO, which invented Ethereum’s first onchain oracle in 2017 to create SAI, the predecessor to the USD-pegged DAI stablecoin.
• The cost optimizations enabled by Schnorr have led to Chronicle Scribe oracles utilizing 22 validators operated by notable DeFi incumbents such as 0x, Infura, dYdX, Argent, Gitcoin, Gnosis, MakerDAO, Etherscan, MyCrypto, and DeFi Saver.

Introduction

Crypto was founded on the ethos of decentralization, permissionless use, and open-sourced values. Yet, in many ways, crypto infrastructure has diverged from the crypto ethos. Even still, some projects are determined to align values and guide crypto back to the values that inspired its creation.

Chronicle Protocol aims to provide transparency and accessibility in how oracle networks serve blockchains. Oracles are middlemen that enable blockchains to access data from other systems and networks. In bridging the gap between blockchains and real-world disparate data sources, applications calling oracle APIs can offer plenty of new use cases.

However, oracle networks have very little visibility around the computing and sourcing of their reported datapoints. Let alone faulty data; some oracles could be inadvertently referencing sources that are susceptible to market manipulation and wash-trading. Regardless, the process is almost always opaque from a user’s perspective. To meet this need, Chronicle Protocol has pioneered a new level of transparency that enables users to easily verify the data reported by oracles.

Background

Chronicle Protocol evolved from the Oracles Core Unit at MakerDAO, which was born out of the work of Niklas Kunkel and Mariano Conti. Together, they co-developed Ethereum’s first onchain oracle in 2017 to create SAI, the predecessor to the USD-pegged DAI stablecoin. In addition to continued coverage of over $5 billion on MakerDAO, Chronicle is rolling out its protocol for public consumption for the first time.

Chronicle is expanding its oracle network outside of the MakerDAO ecosystem to restore crypto’s ethos to oracle infrastructure. Kunkel told Blockworks that he believes “infrastructure in crypto is just like a black box.” He continued this sentiment by explaining that, “No one understands how [oracles] work under the hood. And they’re just fortune tellers that serve up data or prices and are accepted at face value, because [people] trust the brand, and that’s really antithetical to the entire ethos of, ‘Don’t trust, verify.’” Chronicle Protocol addresses this lack of transparency with end-to-end verifiability, where every piece of data can be traced back to each data feed’s original data source queries.

Technology

Key Terms

Oracle networks use various terms to describe the components they use to function. Below are the key technical terms for describing the Chronicle Protocol:

• Oracle: A smart contract representing the data that the network updates
• Validator: An entity that reports the data to the protocol
• Scribe: Chronicle’s name for its oracle smart contracts
• Schnorr Signature: A cryptographic aggregated signature scheme that serves as a digital proof of authenticity and integrity for a message or piece of data

Of note, Chainlink, the most-used oracle provider, uses different naming conventions for oracles and validators. On Chronicle, the entities providing data are called validators and the data smart contracts being reported on are called oracles. On Chainlink, the entities providing data are called oracles (or nodes) and the data smart contracts being reported on are called feeds. While Chainlink is the leading oracle provider in terms of total value and the number of protocols secured, Chronicle existed before Chainlink and was the first oracle network to create and use the terms “oracle” and “feed/validator.”

Scribe

Chronicle’s oracle smart contract system is called Scribe. Scribe overcomes the linear relationship between security and cost, constraining other oracle protocols. Typically, if an oracle protocol increases the number of validators, its costs increase. This is because most other protocols use Elliptic Curve Digital Signature Algorithm (ECDSA) signatures, which have a one-to-one relationship between the signature and the signer. Hence, more signers imply more signatures for an oracle message, which increases the size of the data that needs to be stored on the blockchain. And, of course, more data leads to higher costs.

Instead of relying on ECDSA signatures, Scribe uses a custom oracle consensus algorithm based on Schnorr multi-signature aggregation cryptography. Schnorr signatures are unique in that they enable multiple parties to sign a single aggregated signature. This many-to-one relationship leads to substantial data compression, minimizing the amount of data that needs to be passed to the Scribe oracle smart contract. Chronicle has found that this cryptographic optimization has reduced gas costs on Layer-2 blockchains by an average of 66%, where transaction costs are dominated by the amount of data included in a block.

While Schnorr is newer and less common than ECDSA, it has been battle-tested in Bitcoin since November 2021. Schnorr signatures are also non-malleable. By contrast, ECDSA signatures are inherently malleable; hence, they can be altered by third parties to produce a new valid signature for the same message and public key. This property jeopardizes signature verification, making it possible to manipulate the oracle.

In the context of Scribe, the purpose of Schnorr is to create a digital tamper-proof super-signature signed by all of the validators in order to certify the correctness of a piece of data. This signature is consumed by the oracle smart contract, which verifies its authenticity by checking all signers are legitimate validators and that the data has not been tampered with. Additionally, the cost optimizations enabled by Schnorr have led to Scribe oracles utilizing 22 validators operated by notable DeFi incumbents such as 0x, Infura, dYdX, Argent, Gitcoin, Gnosis, MakerDAO, Etherscan, MyCrypto, and DeFi Saver.

On the contrary, Chainlink is an example of a protocol that does not use Schnorr multi-signature aggregation and uses a small validator set to keep costs low. On prominent L2 networks like Arbitrum, Optimism, Base, and Gnosis Chain, Chainlink only requires at least three node signatures — though the respective block explorers show that these networks primarily get four signatures per update. A smaller node set means that Chainlink is less decentralized and more prone to collusion from nodes, though nodes are still incentivized to act honestly and maintain a good reputation.

Optimistic Scribe

To achieve the same degree of scalability on Ethereum, Chronicle developed a specialized optimistic architecture called Optimistic Scribe. Optimistic Scribe removes the need for the Scribe smart contract to verify the Schnorr signature for every oracle update. Instead, a single validator makes a “promise” that the data associated with a Schnorr signature is correct, and only the promise is evaluated by the Scribe smart contract.

The Schnorr signature is only verified if the promise is challenged within the 10-minute challenge window. If challenged successfully, the optimistic data is removed, the validator that made the false promise is banned, and the challenger is rewarded with a set amount of ETH. This amount will be determined by Chronicle and come from its own reserve. The banning component of the challenge mechanism is a critical property that bounds the frequency of oracle attacks by a dishonest validator to a single attempt.

The challenge reward cannot be gamed/abused by validators due to the challenge mechanism and ban. The banning of validators incentivizes nodes to act honestly. Like every network with a validator set, the network would collapse if all nodes acted dishonestly. In Chronicle’s case, all dishonest nodes would simply be banned upon successful challenges. Engaging in self-challenging dishonest behavior isn't worth the reputational cost, nor the opportunity cost associated with forgoing honest behavior.

Due to the ETH incentive for successful challenges, MEV bots naturally take on the role of challenging dishonest optimistic oracle updates. The Chronicle team is working with large MEV bot consortiums to integrate the challenge mechanism into their MEV mempool search dictionaries. Given enough competition, a race condition will be created, wherein MEV bots compete to be the first to challenge in the exact same block that a dishonest optimistic oracle update is attempted. Chronicle plans to tune the reward to obtain this end goal of near-immediate MEV bot challenges.

A fuller technical description of the optimistic process is as follows:

1. Validators individually query information from all data sources and submit a signature attesting to a particular data value.
2. Validators engage in a signature signing ceremony where they take turns signing on top of a single Schnorr signature. Once a quorum amount of nodes have signed a Schnorr signature, it is considered complete.
3. An individual validator makes a promise in the form an an ECDSA signature to attest that if anyone decodes the Schnorr signature — which represents the consensus of validator signers — it will yield a particular value and timestamp.
4. The Scribe oracle smart contract verifies that the promise was submitted by a valid validator and accepts the data value and timestamp optimistically — this is cost-efficient and subject to a 10-minute optimistic delay. After the delay, the optimistic data value turns into the canonical data value broadcasted by the oracle.
5. If anyone believes that the optimistic data value is dishonest, they can trigger a challenge that verifies the Schnorr signature. If the challenge is successful (proving the validator made a false promise), the challenger is rewarded with ETH, and the dishonest validator is automatically banned by the protocol.

Competitive Analysis

Overview

The top five oracle protocols secure over $29 billion in DeFi-centric value and account for over 96% of the total market. Two of the more pertinent metrics for measuring an oracle protocol’s usage include its total value secured (TVS) and the number of protocols it secures. It’s also important to contextualize the quality of the protocols/assets secured by an oracle network, the breadth of oracle services by the network, and the mechanics of a network’s verifiability.

Total Value Secured

TVS represents the cumulative value of assets that depend on the accuracy and reliability of the data provided by the oracle network. As the first onchain oracle, Chronicle Protocol used to account for 100% of all oracle activity, though as a private oracle unit for MakerDAO. Over the years, Chainlink has grown its market share, consistently accounting for about half of all DeFi-based TVS. Roughly halfway through 2022, WINkLink began to grow its TVS to the size of Chronicle’s today, with other networks also taking relatively small shares of the oracle market.

Chainlink offers a wider breadth of oracle services than Chronicle, which has likely contributed to its dominance in nominal TVS. That is, Chainlink goes beyond market price feeds — though Chronicle plans to roll out more products in the future, particularly around the RWA vertical.

WINkLink’s large share in oracle TVS comes from the large deposits of assets it secures as a TRON-focused oracle. Notably, despite TRON DeFi accounting for a large share in TVL, the blockchain often suffers in usage metrics, with its largest apps rarely exceeding 1,000 unique active wallet users a day. With TRON’s unique dynamic of an unusually high amount of value relative to the size of its user base, metrics of TRON-based projects like WINkLink should be scrutinized under this context.

While Chronicle’s usage has not been waning over the years, it largely has one singular protocol under its coverage in MakerDAO. Chronicle’s public product launch makes the protocol widely available. Hence, Chronicle can service any other DeFi protocol seeking price feeds among other oracle products that Chronicle will be rolling out. Given Chronicle’s long-standing position as the earliest onchain oracle protocol and novel approach to networking and oracle updates, resulting in low fees, protocols may consider onboarding Chronicle oracles in the future.

Protocols Secured

Chainlink is the most used oracle network in crypto in both TVS and protocols secured (333). The next most widely used oracle networks include Pyth (102), TWAP (95), and Internal (43). Chronicle only secures MakerDAO and KEEP Network at the time of writing but will be used by new protocols given its product’s recent public launch.

Chainlink’s dominance in the breadth of coverage may also be a factor in the number and usefulness of its products. In addition to price feeds, it offers developer tooling (for randomness, automation, and quickstart functions), Proof-of-Reserve attestation tools, and other data feeds (e.g., commodities, NFT floor prices, indexes, Ethereum gas, and ForEx). Chronicle also plans on rolling out additional products, which will compete with Chainlink’s dominant market position.

Verifiability

While crypto is touted as an open environment with transparent data, crypto infrastructure protocols often lack the transparency of the blockchains they operate on or serve. This is true for almost all oracle protocols, where ad-hoc users cannot verify for themselves the data provided by an oracle network.

In line with its mission, Chronicle has added features to its oracle dashboard that enable users to verify the data they observe. Chronicle enables verifiability of every single data point where provenance can be cryptographically proven. Its data is sourced onchain, and users can always verify in-browser the data source queries used by validators — down to a particular price point for a particular oracle. While this isn’t necessarily an end product, this core feature makes Chronicle a more trustless protocol compared to its peers.

Final Thoughts

Despite building the first oracle on Ethereum in 2017, Chronicle launched its product for public consumption in September of this year. This intentional delay gave the Chronicle team time to build a solution that doesn’t just meet the needs of crypto as it continues to grow into verticals such as RWA but reinforces crypto’s ethos of decentralization, permissionless use, and open-sourced values. It is the first oracle with true transparency that enables any type of user to verify the value and provenance of any datapoint the protocol reports. While it is technically not the first mover in the public market of oracles, it may be the best positioned to gain market share while maintaining the core values that this industry was founded on.

——