Integrating Canary Nest Oracle (PULL Based)

Canary Pull-Based Oracle

Ultra-fast, verifiable off-chain data access via TEE-based attested WebSocket and HTTPS interfaces

Disclaimer: This documentation is under active development. Interface details, schemas, and integration instructions are subject to change. Full endpoint access and credentials will be provided upon integration request.

---

Overview

Canary’s Pull-Based Oracle enables real-time, tamper-proof access to off-chain data. Unlike traditional oracles that rely on pre-signed payloads from individual providers, Canary fetches data directly from source APIs inside a trusted execution environment (TEE), verifies TLS certificates within the enclave, and generates a cryptographic attestation proving the validity of the data and its execution context.

The result is a unified, attested output stream where applications can fetch or subscribe to accurate and secure price or NAV feeds without having to verify multiple signatures or manage multiple data sources. All outputs are backed by TEE attestations and can be optionally verified on-chain.

---

Core Components

• TEE + SSL Pinning: Data is fetched inside a secure enclave, and SSL certificates are verified at runtime. This ensures the response was received directly from the intended source without tampering.

• WebSocket Streaming: Streams data in real time as events occur. Best suited for low-latency applications or protocols that require continuous price feeds.

• HTTPS Pull API: Allows applications to fetch a point-in-time price or value, with full attestation included. Useful for periodic reads, fallback queries, or fixed-interval updates.

• On-Chain Attestation Verification: Applications can verify attestations using a smart contract. This provides full cryptographic assurance that the data was sourced and processed correctly.

---

WebSocket Streaming

Access: Provided upon request

Subscribe Payload:

{
  "type": "subscribe",
  "identifier": "asset:USDT/USD"
}

Sample Response:

{
  "identifier": "asset:USDT/USD",
  "value": "1.0001",
  "source_timestamp": 1718400000,
  "attestation": {
    "enclave_id": "abc123",
    "measurement": "mrenclave-hash",
    "report": "base64-attestation-report",
    "ssl_chain": "base64-ssl-cert",
    "signature": "base64-signed-hash"
  }
}

• identifier: Asset or feed being subscribed to

• value: Most recent observed value

• attestation: Full TEE attestation and SSL validation proof

• Updates are streamed as source data changes

---

HTTPS API

Access: Provided upon request

Query Parameters:

• identifier: Asset or feed identifier (e.g., asset:USDT/USD)

Sample Response:

{
  "identifier": "asset:USDT/USD",
  "value": "1.0003",
  "source_timestamp": 1718400123,
  "attestation": {
    "enclave_id": "abc123",
    "measurement": "mrenclave-hash",
    "report": "base64-attestation-report",
    "ssl_chain": "base64-ssl-cert",
    "signature": "base64-signed-hash"
  }
}

The HTTPS endpoint allows point-in-time reads of asset prices or values, with all relevant attestations attached.

---

On-Chain Attestation Verification

Smart Contract: CanaryAttestationVerifier (access upon request)

Function Signature:

function verifyAttestation(
  bytes calldata report,
  bytes calldata sslChain,
  bytes calldata signature,
  string calldata expectedIdentifier,
  string calldata expectedValue
) external view returns (bool)

This function verifies:

• The attestation was generated by a trusted enclave

• The source SSL certificate matches the expected domain

• The response value and identifier match the attested output

---

Asset Identifiers

Asset identifiers follow a standardized format:

• asset:USDT/USD

• asset:BTC/USDT

• asset:SOL/USDT

• price:ETH/USD

• index:RWA10

Identifiers define what Canary pulls from the source and how the response is structured.

---

Why Canary’s Pull Oracle is Different

• Data is fetched and attested in real time

• Verifies SSL chain inside the TEE for source integrity

• One unified attestation replaces multiple signatures

• Supports high-frequency WebSocket streams and HTTPS fetches

• Fully verifiable on-chain using a single smart contract

---

For access to Canary’s Pull Oracle and documentation portal, please contact the Canary team directly. Further technical details, endpoint keys, and SDKs will be provided upon integration.