feat: implement BFT multi-oracle state aggregator and slash engine (#…

[DevNetlife]

feat: Implement Consensus-Driven Byzantine Fault Tolerant (BFT) Multi-Oracle State Aggregator and Slash Engine

Closes #1007

Description

This PR implements a Byzantine Fault Tolerant (BFT) consensus state aggregator and slash engine across the backend API services (bftOracleAggregator.service.ts) and the Soroban smart contract oracle module (contracts/soroban/src/oracle_hub.rs).

Previously, price and health score updates relied on individual feeds or simple arithmetic averages, leaving circuit breakers and automated asset pausing mechanisms vulnerable to single-source outlier prices and flash crashes. This update enforces a 2f + 1 quorum agreement across 3f + 1 independent oracle providers, applies median-of-medians filtering with weighted stake voting algorithms, and automatically slashes bad oracle nodes in the database registry (provider_health_registry) when reported values deviate by > 5σ from consensus.

---

Changes Included

Backend Services & API (backend/)

• BFT Oracle Aggregator Service (backend/src/services/bftOracleAggregator.service.ts):
  • Enforces 2f + 1 quorum agreement across 3f + 1 independent oracle providers.
  • Implements median-of-medians filtering and weighted stake median algorithms.
  • Computes robust standard deviation (MAD-scaled σ) to detect outliers > 5σ without variance breakdown.
  • Automatically flags and slashes malicious or out-of-bounds nodes in database records.
  • Generates HMAC-SHA256 cryptographically signed aggregate state payloads.
• Provider Health Registry Integration (backend/src/services/providerHealthRegistry.service.ts):
  • Added flagAndSlashProvider() method to update provider status to slashed, persist penalty details, and record maintenance notes.
• Database Migration (backend/src/database/migrations/049_bft_oracle_aggregator.ts):
  • Created schema tables bft_oracle_providers, bft_consensus_rounds, and bft_slashing_events with appropriate indexes.
  • Updated domain interface definitions in backend/src/database/types.ts.
• REST API Routes (backend/src/api/routes/bftOracle.routes.ts):
  • Registered /api/v1/bft-oracle endpoints (POST /aggregate, POST /providers, GET /providers, GET /rounds/:assetCode, GET /slashing-events).

Soroban Smart Contract Module (contracts/soroban/)

• Oracle Hub Contract (contracts/soroban/src/oracle_hub.rs):
  • Implements OracleHubContract for on-chain BFT consensus validation.
  • Tracks registered oracle nodes and stake weights.
  • Enforces 2f + 1 quorum requirement verification via calculate_required_quorum.
  • Implements submit_bft_aggregate for storing cryptographically signed multi-oracle aggregate state.
  • Implements slash_oracle_node for on-chain node revocation and event publication.
• Crate & Test Export (contracts/soroban/src/lib.rs & Cargo.toml):
  • Exported pub mod oracle_hub; and registered oracle_hub_test target.

---

Verification & Testing

Backend Unit Tests

Ran unit test suite covering quorum calculation, median-of-medians, stake weighting, network partitions, and > 5σ outlier slashing:

npx vitest run tests/services/bftOracleAggregator.test.ts


Soroban Smart Contract Tests
Ran Rust test suite verifying on-chain node registration, quorum formula, valid state submission, insufficient quorum rejection, and node slashing:

bash
cargo test --test oracle_hub_test
Result: 5 passed; 0 failed; 0 ignored; finished in 0.35s

Related Issue
Closes #1007

[DevNetlife]

Done, please review

[Mosas2000]

I spotted a critical Sybil vulnerability in the oracle_hub.rs smart contract where an attacker can bypass the BFT consensus by passing an array of duplicate active addresses in reporting_nodes to artificially inflate the valid_count

[Mosas2000]

@DevNetlife You need to enforce uniqueness within the reporting_nodes vector during the submit_bft_aggregate execution to ensure the quorum represents strictly distinct oracle nodes.

[DevNetlife]

Working on it.

[Mosas2000]

This is highly robust now, thank you.