Why does a settlement firewall need a price oracle at all?

Firewall caps are only meaningful in a common unit of account. JIL's federation bridge enforces its rolling-24h, cumulative-total, and hard-stop drawdown caps in USD per corridor, so every locked asset amount must first be converted to a USD value before the caps can be checked.

What happens when the price oracle's data is stale?

The pricing module treats a stale oracle response as no price at all. When no static override price exists and the oracle is stale or unreachable, the transfer is treated as unpriced, and in strict-pricing mode the lock is denied rather than settled using an assumed or last-known value.

What is the static override book for?

Some assets, including the native token, are not reliably covered by a third-party market oracle. A statically configured override table lets an operator pin a manual price for those assets, and the static override always takes priority over the oracle when both exist.

Oracle-Priced Stale-Fail-Closed Settlement Firewall

Executive Summary

A bridge firewall that caps drawdown "per corridor" only means something if the USD value behind that cap is trustworthy. JIL Sovereign's federation bridge enforces three independent, USD-denominated caps — a rolling 24-hour drawdown, a cumulative total exposure, and a hard-stop ceiling — for every (source cell, destination cell, asset) corridor, computed under a database row lock so concurrent settlements cannot race past a limit.

The USD value behind every check comes from a priority-ordered pricing layer: a statically configured override price (for assets, including the native token, that a third-party oracle may not cover) wins unconditionally when present; otherwise a cached market-price oracle feed is consulted, and its output is discarded — treated as no price at all — when the upstream feed marks its own data as stale. An asset the system cannot confidently price is not settled at a guessed value; it is refused.

Core Innovation: The firewall would rather deny a transfer outright than convert it using a stale or fabricated price. Fail-closed pricing is treated as a first-class safety property of the settlement firewall itself, not an operational afterthought.

Problem Statement

Bridge risk controls are only as good as the price feed behind them. A firewall that silently settles at a stale, zero, or last-known price during an oracle outage is not a firewall at all — it is a false sense of security that fails exactly when markets are most volatile and staleness is most likely to matter.

2

Independent price sources, either one able to veto an unpriced settlement

3

Independently enforced USD caps per corridor — rolling, total, and hard-stop

30s

Default oracle cache window bounding staleness exposure

Why Existing Solutions Are Insufficient

No pricing layer at all: caps enforced in native token units only, blind to the actual dollar risk being moved through a corridor during a price swing.
Single-feed dependence: one oracle, no override for illiquid or platform-native assets the oracle simply does not track.
Fail-open on oracle downtime: settlement proceeds anyway using a stale or default price when the feed is unavailable, exactly when risk controls matter most.
Price-at-intake, never revisited: a price captured once at request time with no distinction between a fresh quote and a minutes-old stale one.

Technical Architecture

Priority	Source	Behavior
1	Static override book	Operator-configured per-asset USD price; wins unconditionally when set, for assets an oracle may not cover
2	Market-price oracle	Cached market feed keyed by asset; a response flagged stale by the upstream feed is discarded, not used

Three Independently Enforced Corridor Caps

Cap	Basis
Rolling 24-hour drawdown	Sum of settled USD value on the corridor within the trailing 24 hours
Cumulative total exposure	Running total USD ever settled on the corridor
Hard-stop ceiling	Absolute USD ceiling the corridor may never exceed

All three checks run against the corridor's row, locked for update, before a settlement is permitted to proceed — concurrent settlement requests on the same corridor cannot each independently observe capacity and jointly exceed the limit.

Fail-Closed Pricing

The pricing function returns no value — not zero, not a stale last-known figure — when neither a static override nor a fresh oracle price is available for the asset. Downstream, an unpriced transfer is treated the same as a transfer that failed a drawdown check: it does not settle.

Cell Quarantine

A cell whose behavior or standing is under review can be moved to a suspended status independent of any single corridor's caps, removing it from further settlement eligibility across every corridor it participates in until the operator restores it.

Prior Art Differentiation

System	Cap Denomination	Stale-Price Behavior	Price Sources
Typical wrapper bridges	Native token units	N/A — no USD conversion	None
Single-oracle rate-limited bridges	Token units or single-feed USD	Fails open (uses last value)	1
JIL Sovereign	USD, normalized per corridor	Fails closed (denies as unpriced)	2, priority-ordered

Patent Claim

Independent Claim 84: A computer-implemented settlement firewall for a cross-cell federation bridge, comprising: a pricing module that resolves a USD value for a locked asset amount by consulting, in priority order, a statically configured override price table and, when no override exists, a cached market-price oracle feed, and that returns no priced value when the oracle feed is marked stale or unavailable; a settlement engine that, for each proposed cross-cell transfer, computes a rolling time-windowed drawdown total, a cumulative total-exposure value, and a hard-stop ceiling for the corridor between the source and destination cells, each maintained under a database row lock; and a gating function that denies the transfer, without moving any value, when the transfer would exceed any of the three corridor limits or when the pricing module returns no priced value for the transfer's asset.