> For the complete documentation index, see [llms.txt](https://axon-finance.gitbook.io/axon-finance-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://axon-finance.gitbook.io/axon-finance-docs/huang-pi-shu-d-jie-suan-wei-jia-he-gui/d2-oracle.md).
# D.2 预言机与喂价安全
> **设计状态**：proposed design。聚合算法为设计方案，阈值参数待定；预言机合作见白皮书 [6.3](/axon-finance-docs/part-vi-lu-xian-tu-yu-zhi-li/part6-roadmap/6-3-team-partners.md)。
## D.2.1 喂价是支付链的隐形命门
货币市场清算、信贷抵押率、风险准备金全依赖「1 单位稳定币现在值多少法币」。喂价一旦出错，会触发本不该发生的连锁清算——这是 DeFi 多次「喂价攻击」与「脱锚踩踏」的根源。AXON 的设计哲学：**面对不确定，宁可保守暂停，也不冒险算错。**
## D.2.2 多源聚合
设 $m$ 个独立喂价源在某时刻提供价格 ${p\_1, \dots, p\_m}$。AXON **不用均值**（易被离群值/操纵拉偏），而用**中位数**：
$$\hat{p} = \mathrm{median}(p\_1, \dots, p\_m)$$
中位数的**崩溃点（breakdown point）为 50%**——少于半数的喂价源被操纵，聚合价格仍稳健。这是抗操纵的第一道防线。
## D.2.3 偏差检测（MAD）
聚合前，用 **MAD（中位数绝对偏差，Median Absolute Deviation）** 识别离群源：
$$\mathrm{MAD} = \mathrm{median}\big(,|p\_i - \hat{p}|,\big), \qquad z\_i = \frac{|p\_i - \hat{p}|}{\mathrm{MAD} + \varepsilon}$$
$z\_i$ 超过阈值 $\tau\_{\text{dev}}$ 的源被标记为离群并**剔除**后再聚合。MAD 比标准差更稳健（不被极端离群值本身污染）。剔除后若**存活源数不足** $m\_{\min}$，则触发熔断（下节）——宁可暂停，不用残缺数据结算。
## D.2.4 熔断状态机
喂价系统是一个显式状态机，**在异常时暂停清算/结算而非盲目执行**：
```mermaid
stateDiagram-v2
[*] --> Live: 正常聚合
Live --> Live: 源间偏差正常 & 存活源≥m_min & 价格在锚定区间
Live --> Halted: 偏差超阈 / 存活源不足 / 脱锚迹象
Halted --> Live: 恢复且连续 K 轮校验通过
Halted --> GovReview: 持续异常 → 治理/人工介入
GovReview --> Live: 处置后恢复
note right of Halted: 暂停依赖喂价的清算与新增信贷
已有仓位冻结清算，避免连锁踩踏
```
`Halted` 态下，依赖喂价的清算与新增信贷被暂停——一次不该发生的清算所造成的信任损害，远大于一次短暂暂停的不便。
## D.2.5 TWAP 兜底与脱锚保护
* **TWAP fallback**：为抵御瞬时闪价操纵，清算等敏感判定可采用\*\*时间加权平均价（TWAP）\*\*而非瞬时价：
$$\mathrm{TWAP}*{\[t-\Delta,,t]} = \frac{1}{\Delta}\int*{t-\Delta}^{t} \hat{p}(s), ds$$
对攻击者，操纵 TWAP 需在整个窗口 $\Delta$ 内持续投入，成本远高于操纵单点。
* **脱锚保护（Depeg guard）**：当稳定币自身对法币锚定出现显著偏离（$|\hat{p} - p\_{\text{peg}}| > \tau\_{\text{peg}}$）时，触发保护——暂停以该资产计价的清算，避免在异常锚定下强平健康仓位。
## D.2.6 喂价安全总览
| 威胁 | 防线 |
| ------ | ----------------- |
| 少数源被操纵 | 中位数聚合（50% 崩溃点） |
| 离群/故障源 | MAD 偏差剔除 + 最小存活源数 |
| 瞬时闪价 | TWAP 时间加权 |
| 稳定币脱锚 | Depeg guard |
| 数据整体异常 | 熔断暂停 + 治理介入 |
喂价安全是 PayFi 货币市场（[E.1](/axon-finance-docs/huang-pi-shu-e-payfi-xie-yi-ji-zhi/e1-money-market.md)）与清算（[E.2](/axon-finance-docs/huang-pi-shu-e-payfi-xie-yi-ji-zhi/e2-liquidation.md)）能安全运转的前提——**没有可信的价格，就没有可信的信贷与清算**。美股带单引擎的链下结算价与结算结果证明也复用本机制（[E.3.5](/axon-finance-docs/huang-pi-shu-e-payfi-xie-yi-ji-zhi/e3-copy-trading.md)）：喂价 `Halted` 态下带单结算暂停，拒绝用残缺数据分账。
***
*下一节：*[*D.3 可插拔合规网关*](/axon-finance-docs/huang-pi-shu-d-jie-suan-wei-jia-he-gui/d3-compliance.md)
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://axon-finance.gitbook.io/axon-finance-docs/huang-pi-shu-d-jie-suan-wei-jia-he-gui/d2-oracle.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.