The program and its keys
On Solana mainnet.
| Program or key | Address | What it does |
|---|---|---|
| The Oraqle program | PQC4C9A9TXN8beQPKPBP3tyMhebymzR5pkyzQeKv9oy | Providers, feeds, signer sets and fee terms; one vault per provider; checks signed reports |
| A provider’s vault | Derived per provider | The USDC account of the provider’s program account, an address no private key controls |
| USDC | EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v | The asset every price and payment is in |
| Treasury | AWpKyLKK1TJZkLenkAxWAUxyJdSvHD28XnjixvPSBFgA | Receives swept platform fees |
| Owner key | AWpKyLKK1TJZkLenkAxWAUxyJdSvHD28XnjixvPSBFgA | The program’s admin |
| Managed attester | DzEKPjK6AYLftJrjL4uDrx14zeHtH6zmevRjsyZ2x9zA | Vouches for a signer that says “Oraqle signed this” |
What each provider keeps
In the program:
- a vault pays out to its provider’s payout address and the platform fee share;
- a provider keeps the fee it accepted when it registered;
- providers manage their own feeds and signers;
- a provider’s signing key stays its own;
- a provider’s accounts, vault, feeds and withdrawals stay in its hands.
Where the money is
- Every payment goes straight from the buyer to the provider’s own vault. Oraqle’s facilitator pays the network fee.
- USDC leaves a vault to the provider’s payout address and, for the platform fee, to the treasury.
- A new payout address waits 48 hours before it applies, and the pending change is shown on the provider’s page. Until then withdrawals go to the current address, and anyone may send one. An offer to hand a provider to another owner is announced on chain when it is made.
- A payment is confirmed by reading the transaction back: it succeeded, and the vault’s balance rose by exactly the price.
The post-quantum layer
- Every report is signed with ed25519 and with SLH-DSA-SHA2-128s over the same message, and a reader accepts it when both verify against the keys registered for the signer.
verify_report_pqchecks both on chain. - A provider’s API key is sealed to Oraqle’s worker with ML-KEM-768 and X25519 together. The post-quantum page has the details.
How it was tested
- The program’s LiteSVM suite runs every instruction against the compiled program, tests refusals by their exact error, among them a managed signer without the attester’s signature, and checks the fee split with property tests.
- End-to-end runs of the whole path on a local validator: payment, settlement, both signatures checked off chain and one changed byte of the SLH-DSA signature refused,
verify_reportandverify_report_pqon chain, a refused replay, packs, withdrawal and the fee sweep, a provider signing with its own key, and an unmodified x402 client paying and reading. - The program’s SLH-DSA verifier is tested against signatures made by two other implementations, and against altered signatures, keys and messages.
Security contact
Write to a direct message to Oraqle on X about anything you find in the program or the site.