Ducat oracle and liquidation

Trace price data into a Bitcoin-enforceable liquidation spend.

Follow these 10 lessons in order, or choose the topic you need. Each lesson combines an explanation, a worked example and practice inside the Guild.

1. How the Ducat oracle works

   Follow one bitcoin price from a signed Chainlink report, through Ducat's precommitted liquidation threshold, to the exact Taproot witness that Bitcoin verifies.

   75 minutes · Open lesson

2. Blind price ladder

   The oracle publishes pre-committed threshold events across collateral-rate buckets so it need not know which users selected which thresholds.

   45 minutes · Open lesson

3. BIP340 commitment hash

   Wallet and oracle compute a tagged commitment over oracle key, network, base price, timestamp, and threshold price.

   55 minutes · Open lesson

4. Nostr transport

   Replaceable signed events distribute current snapshots, threshold contracts, and breach material; relays transport data but are not the trust anchor.

   65 minutes · Open lesson

5. Atomic snapshot promotion

   The current snapshot is published only after its complete ladder succeeds, allowing clients to stay on the prior coherent snapshot after partial failure.

   35 minutes · Open lesson

6. Preimages and Hash160

   A breached threshold reveals secret material whose Hash160 matches the value committed into the vault's liquidation Script leaf.

   45 minutes · Open lesson

7. Liquidation Taproot leaf

   The revealed preimage satisfies the hashlock and a Guardian Schnorr signature satisfies CHECKSIG, making the oracle outcome consumable by Bitcoin Script.

   55 minutes · Open lesson

8. Why the Ducat oracle is Bitcoin-native

   Chainlink supplies authenticated data, but Bitcoin-native enforcement comes from the committed hashlock and signature path inside the Bitcoin UTXO.

   65 minutes · Open lesson

9. Oracle freshness and failure modes

   Stale prices, relay availability, signer rotation, incomplete ladders, configuration drift, and undeployed security fixes must fail closed or be surfaced.

   35 minutes · Open lesson

10. Liquidation cycle

    Detection, preimage release, candidate selection, Guardian validation, repo or trim construction, broadcast, confirmation, and resulting reserve flows form the liquidation lifecycle.

    45 minutes · Open lesson