Provider 0x882ee9cebe3d7b38eebd640... (Collusion)

Proposal

That Provider 0x882ee9cebe3d7b38eebd640b89de01b326351679 be chilled under FIP.02 for collusion.

FIP.02 defines collusion as:

“Collusion, defined as multiple FTSO data providers showing a strong statistical correlation in their submissions or clearly submitting through the same node.”

The first limb asks one question: do the providers show a strong statistical correlation in their submissions? It contains no requirement of agreement, coordination, intent, or common control. The adjacent definition of duplication does contain a common-control element, so the drafters knew how to write one and did not write one here.

No coordination is alleged. None is required for the definition to be met, and nothing below asserts any.

The evidence

Over 120 consecutive voting rounds (1,454,168 to 1,454,287), every pair of the 101 providers revealing values was compared cell by cell. A cell counts only where both providers priced the same feed in the same round, and counts as agreement only where the encoded integer is identical to the last digit.

Provider 0x882ee9cebe3d7b38eebd640b89de01b326351679 submitted byte-identical values to its closest peer on 89.7% of the cells they both priced.

Peer Byte-exact agreement Cells compared
Kiln 89.7% 7,440
Last Oracle 88.8% 7,440
Encode Club 88.7% 7,440
0x7bb4e0ab 88.7% 7,320
Nansen 88.3% 7,440
Scintilla 88.3% 7,440

And 19 further providers at or above 60%, 25 in total.

Providers outside this group agree with one another at about 9.2% on the same measure. Two independent implementations reading different venues essentially never produce the same integer to the last digit on a volatile feed, which is why the field rate is the natural null and why 89.7% is not a coincidence of market conditions.

Provider 0x882ee9cebe3d7b38eebd640b89de01b326351679 holds 0.15% of network voting power. The protocol counts it as an independent observation. On this measurement it is not one.

A separately operated assessment reaches the same conclusion

cerberusonchain.xyz publishes its own analysis of Flare providers, built and run by someone else. Its authors describe it as “an implementation-likeness model, not an accuracy ranking”. It scores candidates against two anchors, a captured deployment of the stock example provider and the passive Flare Network Test provider, using exact value matches, agreement within 5 basis points, mean error magnitude, directional agreement, band crossing and update cadence scored with Cohen’s kappa, fed into a class-balanced logistic model and reported only above a calibrated likelihood of 65%.

It assesses Provider 0x882ee9cebe3d7b38eebd640b89de01b326351679 an example-provider match at 96.5% likelihood (snapshot 2026-09-09).

The two assessments share no signal. One counts byte-exact cells; the other fits a model on proximity, error magnitude, direction and timing against anchor deployments. Neither was built from the other. Where both hold a verdict they agree on 92 of 98 providers, 93.9%.

This is corroboration, not the case. It is inference about which software a provider runs, it carries zero confirmed positives, and it cannot place anyone in breach of FIP.02. The infraction above is the byte-exact agreement, which is a count. The value of a second party arriving at the same group by a different route is that the group is unlikely to be an artefact of how either was built.

How to verify this before voting

Do not take it on trust. Every input is public:

  • This provider’s live figures: 0xb0a1797e… — past readings
  • Method in full, including what it cannot establish: Oracle Independence
  • Procedure: decode each round’s reveals from the Submission contract 0x2cA6571Daa15ce734Bbd0Bf27D5C9D16787fc33f, selector 0x9d00c9fd; take the 4-byte value per feed in canonical order; for every pair, count cells where both priced the feed and the integers are equal. Voting round is floor((unixtime - 1658429955) / 90); round R reveals during R+1.

There is no model here and no reference instance. The figure is a count of reveals already on chain.

The entity, and what a chill has to cover

Role Address
Identity 0x882ee9cebe3d7b38eebd640b89de01b326351679
Submit 0xb0a1797e150ee76f5f2d2de951544c4d592594b7
Delegation 0x99307a8f46cbcc9238a80be8ed955f3e8b491ed4
Node 1 0xe88fb423f4ec8a8b985fbe49548dddc58bed5968

Provider 0x882ee9cebe3d7b38eebd640b89de01b326351679 has 1 registered node. That matters for how the chill is executed rather than for whether it is warranted.

FIP.16 registration weight is computed from two sources: mirrored stake across a provider’s node ids, and the WNat delegated to its delegation address. VoterRegistry.chill takes a list of beneficiaries, so a chill must name the delegation address and every node id above. Chilling the delegation address alone leaves roughly 80% of an average provider’s registration weight untouched, which is the appearance of a sanction rather than a sanction. With every leg named, registration weight is zero and require(_weight > 0) prevents registration for the epochs concerned.

Precedent

The Management Group has chilled for collusion repeatedly, and has done so on findings of the same kind: FLRLabs and LoveFTSO (2023), HXK Oracle, Sirius and CoffeeFTSO (2023), Best FTSO and tSovreign (2023), O1FTSO and Flare Ocean (2024), FTSO UK and SolidiFi Nexus (2025), Sceptre and Rotko (2026). In the FTSO UK and SolidiFi case the group found that “by mirroring data, the providers acted as a single entity, not as the two independent oracles they are registered as.”

Every one of those was voted one provider to a proposal. This proposal follows that practice.

What a chill means here

Under FIP.02 a first chill removes a provider for two reward epochs; a second is a permanent ban. This is a first chill.

A “for” vote is a vote to chill

So far there has yet to be one single response that directly addresses the direct statement in the documentation that says written in plain language do not use the example provider in production.

There has been lots of arguments about why various parties think you should not be able to say don’t use the example provider while those parties make no effort to address the actual matter.

For reliable mainnet operation and reward eligibility, you MUST implement, deploy, and maintain your own robust Feed Value Provider.

I’d vote in favour as the evidence is clear.

That said, I’d rather not be chilling anyone. The documentation is explicit that the example provider isn’t for production use, and the better outcome is that the providers in this group implement and run their own algo.

2 Likes

Usually a proposal have been targeting multiple (2+) data providers when claiming they are colluding. Back when high success rate was the main driver for ftso rewards, we chilled new and old providers if they at some point started to have very similar price submission as other providers. Common spikes were mostly the best evidence as closeness to the median could be explained by other means. Other proofs were sourcing the rewards to a common exchange deposit address showing further cooperation between providers.

The widespread use of the Example Provider is different because developers of Flare Foundation are maintaining the source code. It’s a bit more passive type of collusion because the providers are using an open-source price provider implemented by the Flare Foundation, but how much different is it for two providers using the same closed-source price provider?

There have also been cases where two providers have been chilled or executed a self-chill because they shared common issues causing common downtime. Their price submission were not equal, so the chill happened only because of the similar price provider implementation.

Using the example provider is a combination of both similar pricing and equal price provider implementation.

Based on previous cases, my opinion is that not only provider “0x882ee9cebe3d7b38eebd640b89de01b326351679**”** should be chilled, but every provider that is deemed equal to it/colluding with it.

I support the proposal to chill provider 0x882ee9cebe3d7b38eebd640b89de01b326351679

1 Like

A selling point of the network has long been “100 independent data providers”. That message is diminished if a significant percentage are using example code explicitly labelled as not for production.

I see this first proposal less about the specific provider in question and more about getting clarity from the Foundation on an issue that’s been a constant topic of discussion for too long.

I support chilling this provider as a means of bringing the issue to the Foundation for a definitive decision.

THIS IS BEING POSTED FOR WitterFTSO ON THEIR REQUEST

WitterFTSO supports bringing this to vote, but will vote no. Under FIP.02, infractions are purposefully undefined, because the role of the MG is to look at uncertain situations and determine if they are harmful enough to set a precedent of punishment. Under this premise I don’t think this should be punishable:

  1. I don’t believe the example provider is harmful to the network.
  2. I’m not convinced using the example provider is morally any different than using the example FDC client or FSP, which is widely accepted
  3. I’m not convinced Flare cares about this. They continue to maintain the repository despite knowing it’s used on the network, and have even published announcements around key upgrades

I support bringing this to vote because we will get clarity on the official stance - whether EP usage is a punishable offense or not. An official stance either way is a win for the network.

Posting my opinion and reason for voting yes which is directly relevant to these reasons for voting no posted here on behalf of Witter

  1. Any static formula duplicated enough times to accumulate vote power is directly harmful to the network regardless of source. Many have tried to argue in favor of EP using ML as an example, in certain builds that can be exploitative ML user could output identical feeds to produce the same end result. However that is not the case in live production as is demonstrable by likeness indicators as the tool provided by Burst labs that clearly demonstrates even ML user show superior independence over much of the network. This is a result of using an extremely wide array of data sources, not trying match data sources. Everybody could use every single data source on the planet but aggregation would still vary and the top ten by accuracy would still score higher independence than a cohort of providers all using the same formula.

  2. Morals are irrelevant it’s-

    a) the provided directive from the documentation every providerust read to learn how to participate -

“For reliable mainnet operation and reward eligibility, you MUST implement, deploy, and maintain your own robust Feed Value Provider.”

   This is one single coherent sentence. The foundation has directly stated running the example provider is tantamount to forfeiting your rights to become eligible for rewards. This is not ambiguous. A lack of prior enforcement due to a lack of tooling does not equate a lack of directive. 

Comparing to FDC and FSP is a red herring. The foundation did not state you just build you’re own FDC and FSP to qualify for rewards. They directly instructed you must deploy your own feed vue provider, nothing more nothing less.

  1. Flare Foundation employees have made direct statements about the sheer volume of vp being delegated and staked to Example Provider users being a cause for concern. Will not post quote here, is available in private pips chat for reference.

No matter how much spin is put on any point the foundation has repeatedly made it abundantly clear rampant Example Provider abuse is not tombe tolerated

If everyone runs the Example Provider with minimal changes, the provider set stops adding anything. At that point, why not have Flare select 5 major entities to run the EP code? Same output, less overhead. The fact that this would be the logical outcome shows why EP reliance is a problem.

LightFTSO will be voting No on this proposal. Not because using the example provider is fine and should accepted widely, I think every provider should develop their own implementation. But a proposal like this should include everyone. Otherwise we’re incurring on selective enforcement.

I believe the intended motion is rolling proposals encompassing all EP users vs one mega proposal

I finally got login working and just wanted to bump that yes this is my statement and thank you to BurstFTSO for posting it for me. Cheers!

To respond to Jon:

  1. The issue with ML is not that it produces prices close to other providers, it’s that it may or may not be based in reality at all. There were cases of ML choosing not to use any price data, but just submit a static value because it was the most rewarded on some stablecoins. The idea that this is good for the network while the simple, common sense EP algorithm is bad for the network is a hard argument to make.

  2. I strongly disagree that morals are irrelevant. You think it’s morally wrong because running an EP ignores a warning in the docs. I don’t think it’s morally wrong because I don’t think it’s harmful to the network. This is why we keep going in circles.

  3. I will search for that statement, but as someone pretty plugged into the chat, I’ve seen nothing despite constant pressure on them to say something.

It’s the plan. One step at a time. It’s important to not chill them all at the same time. Afterwards, it’s not more than 5% weight at a time.