Add USDX Proof-of-Reserves feed to FTSO on Songbird
Flare Foundation Proposal to the Infrastructure Provider Management Group (MG) to add a new Custom Feed to the existing set of feeds on Songbird
USDX Proof of Reserves
Background:
With the adoption of STP.10, FTSO supports “Custom Feeds”, enabling feeds for tokens whose value is derived through custom logic rather than from market trading. With the adoption of STP.13, Songbird also supports Flare Confidential Compute (FCC), giving users on-chain access to Trusted Execution Environments (TEEs): cloud-based confidential VMs that attest to their code and state
USDX is Hex Trust’s 1:1 USD-referencing stablecoin and is used as collateral in the FAssets system on Songbird. FTSO currently carries a standard USDX/USD feed, but USDX has no working CeX venue, with only a few DeX options. The Custom Feed computes a value from collateralisation instead, as follows:
An FCC extension reads USDX supply across three chains and reserves from two Hex Trust APIs inside a TEE, signs the result, and publishes it as an FTSO Custom Feed that anyone can verify without trusting the operator. At a high level, the USDX value is calculated as:
price = min(1, Backing / Supply)
where:
-
Supply: USDX totalSupply() on Flare + Ethereum + Songbird
-
Backing: bond reserves (Hex Trust public API) + cash reserves (Hex Trust restricted API)
-
The value is capped at 1, as Hex Trust mints and redeems USDX 1:1 against USD
How the feed is secured:
The price definition, the chain set, the token addresses and the public reserve URL are compiled into the code run by the TEE, so changing any of them requires registering a new code hash, which is a visible and governable event. The feed store admits a signature only from a registered TEE machine of this FCC extension running the latest published configuration. The machine won’t sign an observation more than ten minutes old. This limit is enforced in the enclave, not on-chain
Which sources a machine reads, and who may install credentials in it, change only by a governance transaction, cosigned by data providers holding at least half the epoch’s weight. Additionally, a private input (i.e. the cash reserves figure) moves the published price without ever being published itself
Submitting updates is open to anyone, but the store accepts an update only when at least two machines, observing independently, answer the same request with values within a governance-set bound of each other, and it publishes their median
Business Justification:
-
Collateralisation & DeFi utility: USDX is already used as collateral in FAssets on Songbird, and its reference there is intended to migrate to this reserve-based feed. Valuing USDX by what actually backs it improves its use in lending, borrowing and DEX pricing
-
Accurate risk management: A feed that reflects USDX’s backing enables reliable liquidation mechanisms, and lets protocols react automatically if backing falls below 1:1
-
Ecosystem growth: USDX would be the first custom FCC extension on Songbird. The same design applies to other proof-of-reserves feeds and to attestations over private data
Risk Considerations & Mitigations:
-
As outlined in STP.10, Custom Feeds rely on the correctness of their underlying logic rather than the general FTSO data provider mechanism, so each feed’s risk must be individually assessed
-
Input provenance: The feed does not replace Hex Trust’s custody arrangements or independent attestations, as consumers of the custom feed can only verify what was used for computing the price value, not where its inputs came from
-
Liveness: If the TEE can’t reach a source, the feed stops updating and keeps its last value, so consumers should always check the timestamp
The full trust model, failure modes and security reviews, including open findings: https://github.com/flare-foundation/fce-usdx-oracle.
Ask:
The MG is requested to review and approve adding USDX as a new Custom Feed to FTSO on Songbird, enabling a USDX proof-of-reserves feed via the mechanism defined in STP.10, computed by an FCC extension as enabled by STP.13. For the time being, this feed is added alongside the existing standard USDX/USD feed and does not replace it
Process:
An official request is posted in the open forum on Discourse for MG members to voice their support or raise any concerns. The Flare Foundation will then initiate a transaction from the polling contract on Songbird for MG members to cast on-chain votes either for or against adding the USDX feed to Songbird. Voting is rejection based and requires 66% participation among all eligible MG members and more than 50% of the votes going against the proposal for it to be rejected. Otherwise, the Foundation will proceed with adding the USDX custom feed on Songbird sometime after the voting period expires
MG Proposal Live for Voting