Oracle

The stablecoin needs a USD price, and a new chain has no native source. Anemos derives the ANM/USD price inside consensus, as a pure function of on-chain data, so a node that was offline and re-syncs computes the identical value.

Price rides in the block

The consensus vote and certificate paths are not touched. Instead, each block:

1. A deterministic committee subset (ranked by $\mathrm{Hash}(\text{seed} ,|, \text{valNum})$ over the committed $H{-}1$ sortition seed, so every node re-derives it with zero storage) signs the canonical message $\mathrm{H}(\text{height} ,|, \text{valNum} ,|, \text{price})$ with its validator BLS key and gossips a PriceVote (committee-only, off the consensus vote path).
2. The proposer collects the subset’s votes and aggregates them into a block-body OracleData section — one BLS aggregate — whose hash is folded into Block.Hash(). The existing precommit certificate therefore attests the oracle data with zero certificate-format change.
3. At commit, every node re-derives the subset, checks the signers form a subset meeting the quorum, verifies the aggregate, takes the median, bounds it to ±10% of the running price, and advances the accepted price by a slow integer price TWA.

The accepted price is thus a time-weighted average (price TWA) that converges over ~$1/\alpha$ blocks, not this block’s median. In v0.7 the TWA is faster — about a 3.5-hour time constant (roughly 90% of a genuine move absorbed in ~8 hours), so the peg tracks a real market move in hours rather than a full day, while the per-block move cap of ±10% is unchanged. The faster oracle is paired with committee term limits (see the consensus parameters) — a member can hold a seat for at most ~8 hours before it must rotate out — so a captured subset cannot sit on the committee long enough to drag the faster average. Below quorum the proposer emits no section, the last price carries forward, and a staleness cap halts mint/redeem after $N$ quorum-less blocks.

Tiered quorum keeps the price fresh

When too many of the ~11 selected members are offline, the small subset cannot reach its quorum and the price would otherwise go stale. To avoid that, the subset is tiered and expanding: if the smallest tier is too thin, the proposer deterministically widens to a larger tier (11 → 17 → 25 → the whole committee), each a superset of the last drawn from the same ranking, until enough members attest — so the block still records a fresh price instead of carrying the old one forward. Every node re-derives the same tier from the committed seed, so this stays trustless, and the median, move cap, and price TWA are unchanged. Validators’ feeders cache the latest price and re-use it across attestation attempts, so widening costs only a few extra signatures and never hammers the price APIs.

Omission vs. commission — penalties split by what is provable

Anemos splits oracle penalties by provability: stake is slashed only for provable misbehaviour; unprovable absence is met with a recoverable exclusion, never a stake loss. So neither the block proposer nor the committee can frame or slash an honest validator.

• Deviation is slashed on two axes — how often, and how far off — and the slash escalates on both. A signed price outside the tolerance band is provable (the certificate attests it), so it forfeits a fraction of stake. The repeat-count axis doubles the base penalty for each repeat deviation within a decay window (the level decays back down after sustained good behaviour). The magnitude axis classifies how far outside the tolerance band the reported price fell into three tiers — a small (“jitter”) miss, a “suspicious” miss roughly 2× the tolerance band, or an “egregious” miss roughly 5× the band — and multiplies the repeat-count penalty by roughly ×8 or ×64 for the suspicious/egregious tiers. Each tier also has its own ceiling (roughly 0.64% / 6% / 25% of stake for jitter / suspicious / egregious), and every forfeit is additionally bounded by a hard cap of 25% of stake per period — no single oracle period can cost a validator more than a quarter of its stake, however it misbehaves. A first small (“jitter”) deviation costs nothing (the count still advances, so a repeat escalates), and an egregious deviation advances the repeat count faster, accelerating a validator toward the freeze/ban escalation. The forfeited ANM is moved into the reserve it endangered (a transfer, not a burn). A split-committee guard suppresses slashing when deviators hold ≥ half the attested power, so an honestly bimodal committee is never punished.
• Absence is never slashed — repeat absence excludes you from proposing instead. A node offline for minutes simply did not submit (this is what makes a flaky or low-resource node safe to run). Oracle absence cannot be proven (a proposer could always claim it never received your vote), so it is never a stake slash. Instead, a validator that repeatedly fails to attest the price while others succeed has its oracle-availability score fall, and once below a threshold it is excluded from proposing blocks until it participates again — a recoverable exclusion, not a confiscation. If the oracle is down network-wide (no feeders), nobody is judged absent and consensus keeps running.
• The exclusion is bounded, so it can never halt the chain. The availability gates may exclude at most one third of the seated committee at once — if more members are below the thresholds, the highest-scored of them stay eligible to propose (deterministic tie-break by validator number) — and if a height ever churns a full proposer rotation without a commit, the gates are ignored entirely for that height. A proposer quorum therefore always exists, even if every seated member’s score degrades at the same time.

Oracle-participation reward — making attestation pay, not just cost

The deviation slash above is a stick: it makes a bad price expensive. On its own, though, a good price pays nothing, so an honest validator has no positive reason to run a feeder beyond avoiding punishment. Anemos adds a carrot: on every oracle-active block, a 10% slice of the validator reward pool (before the proposer/operator split) is carved out and minted at commit, then split equally among that block’s correct attesters — the committee members who signed a price that stood inside the accepted band. An attester who deviated, who did not attest at all, or who is currently frozen or banned, gets none of this slice; any leftover (unclaimed) share is credited to the stablecoin reserve rather than lost. A pool validator’s share flows through the same commission/escrow split as its ordinary block reward.

This closes the “ban is never a free opt-out” gap: a validator that stops attesting to dodge the deviation slash, or that is frozen/banned for repeat deviation, does not just lose the right to propose blocks — it also forfeits this reward stream, on every block, for as long as it stays out. Correct attestation becomes individually economically rational on top of being the safe choice.

Trust ceiling

Moving the median requires a majority of that block’s subset, and even a fully captured subset moves the committed price by at most ~$\alpha\delta \approx 0.008%$ that block (move cap + slow price TWA). The price TWA integrates thousands of attestations across many independent random subsets — effectively the whole committee — so dragging the peg requires a sustained majority over many blocks. Committee seats are stake-weighted VRF sortition, bond-lagged, rotation-capped, and term-limited (a member rotates out after ~8 hours), so this reduces to an honest-majority-of-stake assumption, the same one consensus already makes.

Off-chain feeder

Each committee validator runs an off-chain feeder that pulls the ANM/USD price, takes a robust median, and — only when it is in the next block’s subset — signs and gossips a PriceVote. The feeder is not consensus-critical: the on-chain layer re-medians across the subset with quorum, the move cap, the price-TWA lag, and deviation slashing. The production feeder pulls from several public market-data APIs (CoinGecko, CoinPaprika, CoinMarketCap); it is configurable so a validator can point it at any source.