Price Oracles + Signed Messages On Off Chain by Mariano Conti

okay hello everybody my talk is gonna be about price Oracle's and how we can use sign messages to move some computations off chain and save on gas costs and increase acuity and hopefully some other things that I'm gonna be mentioning so my name is mariano Conti I'm the head of Oracle's at maker Dao and gonna talk quickly about what is an Oracle in the context of a blockchain blockchain knows nothing about outside data so for smart contracts like ours the dai credit system where we need to know the price of ether the price of mkr of the price of any asset that we eventually use we need a way to input that data from the outside world into a smart contract and that is what we call an Oracle and the way you do decentralize secure Oracle's is usually to have a lot of different people sending data to the blockchain and then aggregating that data in a way that is safe and other smart contracts can use so I'm gonna need a little bit of help from the audience now and please don't look at your phones I need three people to give me the price of ether in USD 220 how much 170 235 okay let's do this so okay so up there we have the official eath USD price field for maker it's 20 18.75 at the moment and the audience me realized is 220 so that was actually very very good of course in the real world you would not have only three sources but I think for this it went it went pretty well so let's look at the naive implementation let's say we have those three prices that the audience gave us and there's three smart contracts that continuously push prices to them and let's say they pushed these prices so as we saw if we have a media miser contract that reads from all all of these three feeds we can see that calculates the correct medium and anybody can use this price field for whatever they need so how this would happen is every time an Oracle updates it would trigger the media Nizer that would read from this authorized sources it would compute the median unchain meaning that it would grab as you can see these prices are not sorted you will need to sort 172 20 and 235 and then calculate the median if this were an even number of feeds it would have to grab the two in the middle and get the average so as you can see there's a lot of computation going on in the blockchain and this is like not a very good way to do this some of the drawbacks also include like high gas costs it's a lot dependent Network latency so when you have like a cryptic hideous event and you have Oracle's send in transactions and these transactions are not getting mined for something like price feeds where you need real-time price data you can have a really nasty consequences if your contracts are not up to date also every single Oracle needs to have eath balance so they can send transactions and of course that means they need they need to have a sink parity or get node running right you can probably use in fira but security concerns you may have may prevent you from that so you would need a big computer with a big SSD sometimes guess and partly fail you need the robust implementation there and I just put there a couple of URLs for the way we do this currently its price freedom media nicer you can read the smart contracts but I want to propose a better way to do this and this is using signed messages so the first advantage of signing a message with your aetherium account is that it's free it's totally free I mean theorem account is nothing more than a public and a private key and you can sign data with that private key in fact that's what a transaction is it's just a signed message with a very specific way of signing specific data such as the from the to the data the nonce gas price chain all that kind of thing so Oracle's need know with balance they can just be signing messages all the time you can move some of the calculation of chain as we will see in a moment you do not have a run a note there are programs that will let you sign messages without running gaither priority and you can run our stuff in like a five years d VPS a month and a couple of our newer github ripples are medium and terror so let's go back to the original prices we had 220 170 235 so let's transform those two way then to you in 256 which is format that solidity likes and understands we're gonna use the same three theorem accounts without any balance and we're gonna assign these values as a theorem messages so this is live so let's see if this works and okay here we go these are three signed messages using the three theorem accounts that we saw before and okay we're good the first one we recovered back to the original account second one as well and the third one as well this is all running live I'll show you in a second this is not like this is all real okay so how did it work right now I'm using sign and EC recover from the web three that if that personal library and it's just as simple as calling the sign method with the price and the account and an empty password which you do not want to do in production the price is just the the price we saw converted to you to wait and convert it to you in 256 and the account is the account that you want to sign with and you get this message back which is a 65 byte signature and to recover that you just grab the original data that you signed which is the price and the message the 65 byte signature you run it through you recover and you get the original aetherium address to sign it so as you can see this is very powerful if you can whitelist addresses that connect us your Oracles or us your wallet signers or basically anything you want just a quick word about the message this 65 bytes are compared stuff one bite for the V which is the last part over in the message the one B then 32 bytes for R and 32 bytes for s which let's hope you can see this is a simple version of our media nicer with no times terms no nonsense it's just a little code to show you how this works so you could you would grab the messages from all these accounts put them in order first so essentially there you already save yourself from doing computation on chain since you can very easily grab all these messages sort them by price off chain and then just send them to the smart contract which as you can see the only thing it will do this down you where you can see kak 256 you will see that easy recover that's doing the same thing that we did here in the presentation it's gonna grab the price it's going to grab the hash message and it's gonna get back who signed that message and as long as in this next slide you'll see up top that you have a whitelist of who can sign it then essentially you've got a really nice Oracle over there you check that the values are ordered you check for uniqueness so they cannot send the to price assigned by the certain Oracle and in the end you just do a quick sanity check that the median is exactly the the one that's in the middle so some things to keep in mind that this is not production already like I said we use x times nonces and some other magical stuff and three Oracle's is not a lot as you can see the prices were not incorrect because the medium turned out to be very accurate but if you have three Oracle's then if to collude then you're gonna have a bad time for example in production we use about fourteen of them and you meet away a way to transport design messages the nice thing about just using transactions is that everything that's in the blockchain but with this you need a way to move all these messages between machines and we use and love Scarl but there's a couple of other uses of sign messages you can have a multi-sig wallet a lot of wallets we see every day somebody has to send a transaction to propose an action then people have to send transactions to vote for them and then the final person who sends the transaction and approves is the one that pays for all the gas so why not just sign messages saying that you intend to to approve a proposal and then somebody else can just grab all these messages and send them for you which is exactly a way that our media Nizer does as long as you can grab all these messages anybody can send them because only authorized signers will be able to actually change the state of the contract they're very useful for real ayres we've seen a couple of implementations now people can pay in their own tokens or whichever token the relay accepts for the gas and we're looking forward to seeing what else people come up with just quick detour eath is still seven 18.75 that's way too low so that is my segue to just give a quick shout out to multi collateral die which is coming this year with a lot of improvements including the stuff with the Oracles that I mentioned and just want to say that for the hackathon we're going to have up to 4,500 die worth of bounties and hope you can join our community and over there's our URL the chat the Twitter or whatever and we're always looking forward to talking with you about well mostly anything I talk about Oracle's but you can talk to me about whatever you want so thank you [Applause] oh I just want to say that this is not this is really adapt those are all the errors that happen during that if you want to see the source code just go to get help maker dial it Berlin and you can check it out and maybe send a pull request thank you [Applause]