Pyth’s scheme has two pillars: cryptographically signed, per‑publisher price components and a robust, confidence‑aware aggregation algorithm that generalizes the median. Each update carries a value and confidence from each publisher; the protocol turns those into a single aggregate price/confidence per slot using a vote construction over each publisher’s price and its ±confidence, then computes dispersion from the interquartile structure of those votes.
Message and signature basics
Each publisher submits a signed price component containing price, confidence, exponent (decimals), and publish time; consumers see the same fields on-chain (price, conf, expo, publish_time) after verification, preserving provenance for auditing.
Updates are attributable to publisher keys and carried cross‑chain as signed packets; destination contracts verify signatures before committing the new aggregate to storage, ensuring origin integrity. While this flow is documented at a system level elsewhere, the core per‑publisher fields are consistent.
Aggregation: voting view
Three votes per publisher: For each publisher i with price pᵢ and confidence cᵢ, the algorithm places votes at pᵢ−cᵢ, pᵢ, and pᵢ+cᵢ. It then takes the median of all votes (stake‑weighted in the generalized form) as the aggregate price. This makes the price robust to outliers and sensitive to the reported confidence.
Confidence from quartiles: It computes the distances from the aggregate price to the 25th and 75th percentiles of the vote set and selects the larger as the aggregate confidence, yielding a symmetric interval that reflects both publisher‑reported uncertainty and cross‑publisher dispersion.
Aggregation: optimization view
Equivalent objective: The same aggregate price R minimizes the convex objective 13∑i∣R−pi∣+23∑imax(∣R−pi∣−ci,0)31∑i∣R−pi∣+32∑imax(∣R−pi∣−ci,0), optionally with stake weights sisi applied to each term. The second term penalizes distances outside a publisher’s confidence, pulling R inside overlapping intervals where possible.
Why it’s robust: This formulation generalizes the ordinary median (which minimizes ∑i∣R−pi∣∑i∣R−pi∣) and ensures single‑source extremes have limited influence unless many publishers agree or report very tight confidence around that level.
Confidence semantics
Reported vs aggregate confidence: Publishers report their own confidence as an error radius; the aggregate confidence is not a simple average but a function of the vote interquartile range anchored at the aggregate price, so it grows when publishers diverge and shrinks when they agree tightly.
Practical effect: During events or venue dispersion, the aggregate confidence expands, signaling integrators to widen risk buffers (e.g., funding, liquidation thresholds) rather than over‑trust a single tight input.
Implementation notes developers see
On-chain struct: The Pyth price struct exposes price, conf, expo, publish_time; clients rescale by expo to human units. This is the same data the aggregation emits every slot, giving downstream apps a deterministic interface.
Slot cadence: Aggregation runs each slot so the aggregate and its confidence are refreshed multiple times per second at the data plane, maintaining low‑latency availability for pull‑based consumers. The aggregation math above applies per slot consistently.
Why this design resists manipulation
Outlier control: A publisher posting an extreme pᵢ gets bounded influence because the median of a dense vote set is stable, and the ±cᵢ votes keep weight near plausible ranges.
Confidence‑aware weighting: Tight, credible cᵢ concentrate influence near pᵢ; wide cᵢ dilute it. The aggregate confidence expands when sources disagree, communicating uncertainty to downstream logic.
Bottom line: publishers sign per‑symbol price components with a value and confidence; Pyth aggregates them by taking the median of each publisher’s price and ±confidence votes, then sets the aggregate confidence from the vote interquartile distances. Equivalently, it solves a convex objective that blends median‑style loss with confidence‑outside penalties, yielding robust, confidence‑aware prices each slot with clear on‑chain fields for consumers.