Enum OracleSafetyViolation 

pub enum OracleSafetyViolation {
    ExcessiveDeviation = 1,
    StaleData = 2,
    CrossSourceMismatch = 3,
    InsufficientLiquidity = 4,
    ThinSampling = 5,
    CircuitBreakerOpen = 6,
    StaleSnapshot = 7,
    ExternalContractFailure = 8,
    DecimalsMismatch = 9,
    UnexpectedDecimals = 10,
}

Reasons a guardrail has rejected a price; the Err payload of every safe_oracle public API.

Discriminants are stable u32 values (1..=10) so they can be carried as the u32 inside PriceResult::Err and re-hydrated through PriceResult::into_result. Integrators surfacing oracle violations to their own callers typically mirror these discriminants 1:1 in their own error enum (see mock_lending::MockLendingError for the canonical reference) so audit logs preserve which guardrail tripped.

Spec

See spec §4 — Error Enum. The seven variants here implement the spec’s required violation taxonomy. Phases 1–5 wired the variants in order: 1–3 (Layer 1) in Phase 2, 4–5 (Layer 2) in Phase 4, 6 (circuit breaker) in Phase 5, and 7 (stale snapshot) introduced alongside the freshness check in Phase 4.

Variants

ExcessiveDeviation = 1

StaleData = 2

CrossSourceMismatch = 3

InsufficientLiquidity = 4

ThinSampling = 5

CircuitBreakerOpen = 6

StaleSnapshot = 7

ExternalContractFailure = 8

An external contract (Reflector primary feed or LiquidityRegistry) failed unexpectedly — host-level trap, contract upgrade incompatibility, storage corruption, or any other invocation error surfaced through Soroban’s try_* client variants. Hardening Phase debt #4 added this variant so cross-contract failures arrive as regular guardrail violations rather than propagating to the caller (which would prevent auto-halt from committing — same Phase 5.2 v1 root cause).

Secondary-feed failures intentionally do NOT surface as this variant — check_cross_source skips silently on secondary trap, consistent with None and “secondary returned None” semantics.

DecimalsMismatch = 9

Cross-source check rejected because primary and secondary oracles report different decimals() values. Comparing prices across different scales would produce false signals; fail explicitly so integrators see a misconfigured pair rather than always-fires CrossSourceMismatch.

Recovery: verify both oracles target the same precision (Reflector mainnet = 14). Phase 7.2 closure of the lib.rs:262 reconciliation plan — what was previously documented as integrator responsibility is now enforced at library level.

UnexpectedDecimals = 10

Primary Reflector reported a decimals() value different from REFLECTOR_DECIMALS_EXPECTED (14). The library’s BPS arithmetic and staleness calculations are calibrated for 14-decimal precision; a different value indicates a misconfigured oracle address or a Reflector contract upgrade that has changed the precision contract.

Recovery: verify oracle address matches Reflector’s published mainnet/testnet address. If Reflector intentionally changed decimals, safe-oracle library version bump is required. Phase 7.2 closure of the lib.rs:820 plan.

Implementations

impl OracleSafetyViolation

pub const fn spec_xdr() -> [u8; 2908]

Trait Implementations

impl Clone for OracleSafetyViolation

fn clone(&self) -> OracleSafetyViolation

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for OracleSafetyViolation

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl From<&OracleSafetyViolation> for Error

fn from(val: &OracleSafetyViolation) -> Error

Converts to this type from the input type.

impl From<&OracleSafetyViolation> for InvokeError

fn from(val: &OracleSafetyViolation) -> InvokeError

Converts to this type from the input type.

impl From<OracleSafetyViolation> for Error

fn from(val: OracleSafetyViolation) -> Error

Converts to this type from the input type.

impl From<OracleSafetyViolation> for InvokeError

fn from(val: OracleSafetyViolation) -> InvokeError

Converts to this type from the input type.

impl PartialEq for OracleSafetyViolation

fn eq(&self, other: &OracleSafetyViolation) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl TryFrom<&Error> for OracleSafetyViolation

type Error = Error

The type returned in the event of a conversion error.

fn try_from(error: &Error) -> Result<Self, Error>

Performs the conversion.

impl TryFrom<&InvokeError> for OracleSafetyViolation

type Error = InvokeError

The type returned in the event of a conversion error.

fn try_from(error: &InvokeError) -> Result<Self, InvokeError>

Performs the conversion.

impl TryFrom<Error> for OracleSafetyViolation

type Error = Error

The type returned in the event of a conversion error.

fn try_from(error: Error) -> Result<Self, Error>

Performs the conversion.

impl TryFrom<InvokeError> for OracleSafetyViolation

type Error = InvokeError

The type returned in the event of a conversion error.

fn try_from(error: InvokeError) -> Result<Self, InvokeError>

Performs the conversion.

impl TryFromVal<Env, &OracleSafetyViolation> for Val

type Error = ConversionError

fn try_from_val( env: &Env, val: &&OracleSafetyViolation, ) -> Result<Self, ConversionError>

impl TryFromVal<Env, OracleSafetyViolation> for Val

type Error = ConversionError

fn try_from_val( env: &Env, val: &OracleSafetyViolation, ) -> Result<Self, ConversionError>

impl TryFromVal<Env, Val> for OracleSafetyViolation

type Error = ConversionError

fn try_from_val(env: &Env, val: &Val) -> Result<Self, ConversionError>

impl Copy for OracleSafetyViolation

impl Eq for OracleSafetyViolation

impl StructuralPartialEq for OracleSafetyViolation