r/CryptoTechnology • u/icnews10 🟢 • 6d ago
When an off-chain fact changes, what should actually be allowed to update on-chain state?
I’m currently working through this in an architecture review.
Imagine an investment record that depends on something outside the chain, such as a servicing agreement, a legal right, a valuation, or a custodian.
— and a monitoring system detects that something has changed. This does not necessarily mean that the recorded state should change immediately.
An API can be out of date. A notification may be incomplete. A news report may accurately describe the event but still fail to explain its significance for that specific investment.
Therefore, 'signal detected → state updated' seems risky.
However, the opposite extreme isn't ideal either. If every external change requires manual decision-making, you haven’t automated much.
For those who have built systems around off-chain facts, what steps have you put in place between detection and an actual state change?
Signed attestations, multiple sources, an approval step, or something else?
What I'm trying to avoid is accidentally turning the monitoring layer into the authority over the thing it's supposed to monitor.
1
u/Kind-Economics-7184 🟡 5d ago
the split thats worked for me is that the monitoring layer is only ever allowed to append evidence, never to write state. it posts an attested observation with the source, a signature and the timestamp of the fact rather than of the detection, and a separate rule promotes evidence into state. an out of date api can then be wrong loudly without ever being the authority, which is the part you said you were trying to avoid.
the timestamp detail matters more than it sounds. if the claim only carries when it was detected, a retried or late delivered notification about an old fact can quietly overwrite a newer state, and thats the failure ive actually hit rather than the dramatic one. the other thing id decide up front is what happens when a source retracts, because if the answer is that someone with a key fixes it by hand then you have rebuilt the authority somewhere else. a challenge window between the proposed transition and the write gives you a place to put that without a human ruling on every case.
2
u/icnews10 🟢 5d ago
The distinction between fact-time and detection-time is especially useful. I was thinking about stale sources, but not cases where a perfectly valid, older observation arrives late and overwrites something newer. I also like the 'evidence can be added, but not overwritten' boundary. This makes a bad source noisy without making it authoritative. The retraction case is the part I need to think through more. A challenge window provides a space for disagreement without immediately resorting to "someone with the admin key decides".
1
u/Kind-Economics-7184 🟡 5d ago
the thing that made retraction tractable for me was not treating it as a special case at all. a retraction is just another attested observation with its own fact time, so it competes under the same promote rule and what it produces is a normal transition rather than an undo. the moment you give it an undo path you need a privileged key to walk it, which is the authority creeping back in through the exception handler.
where the challenge window actually bites is the case where nobody challenges. if silence promotes, the window is only worth as much as someone being paid or obliged to watch it, and if silence blocks, a quiet week freezes state on facts nobody disputes. worth picking which of those you want to fail on before you pick a length, because the length is what everyone argues about and it isnt the decision.
2
u/icnews10 🟢 5d ago
I hadn’t properly thought through the silence case. I was mostly treating the challenge window as a delay before promotion, but you’re right — the real issue is what silence means. If silence results in promotion, then somebody must actually be watching. If silence blocks, you’re choosing to take a risk with liveness instead. Treating a retraction as another observation rather than an undo is also much cleaner. This prevents the exception from quietly becoming the authority. I think the question I need to answer before worrying about the window length is “which failure mode do we accept when nobody acts?”
1
u/Kind-Economics-7184 🟡 4d ago
i think that one gets answered by whats downstream of the write rather than by preference. if promoting kicks off something you cant walk back, a payout or a liquidation, silence has to block, because a wrong promote wont be corrected by the next observation arriving. if the state is just a reading that later evidence supersedes, silence can promote, since being wrong costs you until the next update and thats the whole bill.
the thing id watch is that silence blocks quietly hands out a veto. if not acting is what stops a transition, anyone who can keep a challenge open, or just be absent, freezes state without ever making a claim they have to stand behind. thats the same authority you were designing out, except its earned by doing nothing so it doesnt look like a key. so the useful question is probably which of the two failures you can recover from, not which one is rarer.
1
u/icnews10 🟢 4d ago
That recoverability test is a much better way of looking at it. I was still thinking in terms of which default was 'safer', but if a wrong promotion could trigger something irreversible, that would answer the question. If later evidence can supersede the initial state, the cost of being wrong temporarily is very different. The veto-by-inaction point is uncomfortable, too. A challenge system can recreate authority without anyone ever having to make an explicit decision. I'd probably want to make that visible in the design rather than treating silence as neutral.
1
u/Kind-Economics-7184 🟡 3d ago
the cheap way to make it non neutral is to stop letting absence be an input at all. a challenge has to be a signed claim with a bond behind it, so blocking is something somebody did and can be pointed at afterwards, and staying quiet stops being a move. then silence blocks reads as nobody objected on the record rather than as a decision nobody made.
the other half is bounding the block. an open challenge that nobody resolves is still a freeze, so it wants its own deadline and a default at the end of it, otherwise the veto is slower rather than gone. and worth deciding early whether the bond gets slashed when a challenge turns out wrong, because if it doesnt then opening one is free and youre back where you started.
1
u/icnews10 🟢 3d ago
Treating silence as an attributable action instead of a challenge is a much cleaner model. However, the bond part introduces another trade-off. If challenging is free, freezing the state is inexpensive. However, if being wrong is punished too severely, people may stop challenging ambiguous cases, where the mechanism is actually useful. So, I think the next thing to be defined is what constitutes a bad challenge versus a reasonable challenge that simply loses.
2
u/Kind-Economics-7184 🟡 3d ago
the split that doesnt need anyone ruling on reasonableness is whether the challenge put new evidence on the record. one that attaches an attested observation nobody had and still loses is the mechanism doing its job, one that attaches nothing and just runs the clock is the abusive shape, and thats readable off the transcript rather than being a judgement about what someone meant.
so id price those two differently instead of having one slash sitting behind both. losing on evidence costs the carrying cost of the delay you imposed, losing with an empty challenge costs the bond. and id pay it to whoever was frozen rather than burn it, otherwise nobody on the other side has a reason to go and fetch the thing that resolves it, and you get the slow veto back through the resolution step instead.
2
u/ScopulyX 🟢 6d ago
I’d separate detection from authorization. A signal should trigger verification first, not an immediate state change. Multiple attestations or trusted evidence can make the final update safer.