Configurable oracle sources, not just for bifrost

[mrq1911]

Dynamic version of bifrost oracle interface, allowing to add more sources using extrinsic. Each source would have list of origins/accounts that are able to set it.

This would allow us to use our EMA oracle logic for external oracle sources.

Also set oracle extrinsic should reserve space for calculation of its oracle on end of the block to make sure its always recalculated when updated - set oracle extrinsic shouldn't ever fail.

[dmoka]

Configurable Oracle Sources

Overview

This feature introduces a dynamic, configurable system for external oracle sources, replacing the current hardcoded
bifrost oracle implementation. It allows governance to register multiple external oracle sources, each with its own
authorized accounts that can submit price updates.

Motivation

Currently, the EMA oracle pallet has a hardcoded BIFROST_SOURCE with a dedicated BifrostOrigin config type. This
approach doesn't scale when multiple external oracle providers need to be integrated. By making oracle sources
configurable, we can:

• Add new external oracle sources without runtime upgrades
• Manage authorized accounts per source via governance
• Reuse the existing EMA oracle logic for all external sources

Design Decisions

Decision	Choice	Rationale
Authorization model	Account-based per source (StorageDoubleMap)	O(1) lookup, no limit on accounts per source
Price deviation check	None	No price deviation check for external sources; authorized accounts are trusted, and clamped oracle will be used to prevent attacks
Whitelist behavior	Bypass	External sources can update any asset pair (same as current bifrost)
Source management	AuthorityOrigin	Consistent with existing whitelist management
Migration	Deprecate bifrost	Keep update_bifrost_oracle as deprecated, delegate to shared internal logic
Accumulator	Single unbounded Accumulator	No separate ExternalAccumulator; soft limit only for AMM trades
Weight reservation	fractional_on_finalize_weight per call	Each external oracle call pays for its own on_finalize processing

Accumulator Changes

Make Accumulator unbounded

The existing Accumulator changes from BoundedBTreeMap to a regular BTreeMap:

/// Accumulator for oracle data in current block that will be recorded at the end of the block.
#[pallet::storage]
#[pallet::getter(fn accumulator)]
pub type Accumulator<T: Config> = StorageValue<
    _,
    BTreeMap<(Source, (AssetId, AssetId)), OracleEntry<BlockNumberFor<T>>>,
    ValueQuery,
>;

Rationale: The accumulator is always emptied via take() in on_finalize every block, so there is no storage
growth risk. The block weight budget is the natural limit on how many entries can be added.

Soft limit only for AMM trades

MaxUniqueEntries becomes a soft limit enforced only for non-external sources in on_entry. External oracle entries
bypass this check because each set_external_oracle call pays its own fractional_on_finalize_weight.

pub(crate) fn on_entry(
    src: Source,
    assets: (AssetId, AssetId),
    oracle_entry: OracleEntry<BlockNumberFor<T>>,
) -> Result<(), ()> {
    if !T::OracleWhitelist::contains(&(src, assets.0, assets.1))
        && !ExternalSources::<T>::contains_key(src) {
        return Ok(());
    }

    Accumulator::<T>::mutate(|accumulator| {
        if let Some(entry) = accumulator.get_mut(&(src, assets)) {
            entry.accumulate_volume_and_update_from(&oracle_entry);
            Ok(())
        } else {
            // Soft limit: only for non-external sources (AMM trades)
            if !ExternalSources::<T>::contains_key(src)
                && accumulator.len() >= T::MaxUniqueEntries::get() as usize {
                return Err(());
            }
            accumulator.insert((src, assets), oracle_entry);
            Ok(())
        }
    })
}

Storage

New Storage Items

/// Registered external oracle sources.
/// Managed by AuthorityOrigin.
#[pallet::storage]
pub type ExternalSources<T: Config> = StorageMap<
    _,
    Twox64Concat,
    Source,
    (),
    OptionQuery,
>;

/// Authorized accounts per external oracle source.
/// Managed by AuthorityOrigin via add/remove extrinsics.
#[pallet::storage]
pub type AuthorizedAccounts<T: Config> = StorageDoubleMap<
    _,
    Twox64Concat,
    Source,
    Twox64Concat,
    T::AccountId,
    (),
    OptionQuery,
>;

Extrinsics

1. set_external_oracle

Allows authorized accounts to submit oracle price updates.

Uses VersionedLocation for assets (same as current bifrost) to support cross-chain asset identification.

Weight includes fractional_on_finalize_weight so each call pays for its own on_finalize processing — same pattern
as AMM trades.

#[pallet::call_index(6)]
#[pallet::weight(
    <T as Config>::WeightInfo::set_external_oracle()
        .saturating_add(fractional_on_finalize_weight::<T>(T::MaxUniqueEntries::get()))
)]
pub fn set_external_oracle(
    origin: OriginFor<T>,
    source: Source,
    // Boxed to avoid large parameter size (required by utility pallet batch calls)
    asset_a: Box<polkadot_xcm::VersionedLocation>,
    asset_b: Box<polkadot_xcm::VersionedLocation>,
    price: (Balance, Balance),
) -> DispatchResultWithPostInfo {
...
}

2. register_external_source

Registers a new external oracle source.

#[pallet::call_index(3)]
#[pallet::weight(<T as Config>::WeightInfo::register_external_source())]
pub fn register_external_source(
    origin: OriginFor<T>,
    source: Source,
) -> DispatchResult {
...
}

3. add_authorized_account

Adds an authorized account for an existing external source.

#[pallet::call_index(4)]
#[pallet::weight(<T as Config>::WeightInfo::add_authorized_account())]
pub fn add_authorized_account(
    origin: OriginFor<T>,
    source: Source,
    account: T::AccountId,
) -> DispatchResult {
...
}

4. remove_authorized_account

Removes an authorized account from an external source.

#[pallet::call_index(7)]
#[pallet::weight(<T as Config>::WeightInfo::remove_authorized_account())]
pub fn remove_authorized_account(
    origin: OriginFor<T>,
    source: Source,
    account: T::AccountId,
) -> DispatchResult {
...
}

5. remove_external_source

Removes an external oracle source and all its authorized accounts.

#[pallet::call_index(5)]
#[pallet::weight(<T as Config>::WeightInfo::remove_external_source())]
pub fn remove_external_source(
    origin: OriginFor<T>,
    source: Source,
) -> DispatchResult {
...
}

Bifrost Deprecation

Keep update_bifrost_oracle (call_index 2) but mark as deprecated. Internally it should delegate to the same shared
logic as set_external_oracle (asset conversion, price validation, accumulator insertion).

Migration should register BIFROST_SOURCE as an external source with the appropriate authorized accounts.

New Error Variants

#[pallet::error]
pub enum Error<T> {
    // ... existing errors ...

    /// The external oracle source is already registered.
    SourceAlreadyRegistered,
    /// The external oracle source was not found.
    SourceNotFound,
    /// The caller is not authorized to update this oracle source.
    NotAuthorized,
}

New Events

#[pallet::event]
pub enum Event<T: Config> {
    // ... existing events ...

    /// A new external oracle source was registered.
    ExternalSourceRegistered { source: Source },
    /// An external oracle source was removed.
    ExternalSourceRemoved { source: Source },
}

Migration

• Register BIFROST_SOURCE as an external source in ExternalSources
• Add current bifrost authorized accounts to AuthorizedAccounts
• Mark update_bifrost_oracle as deprecated (keep for backwards compatibility)