Crypto Price-Feed by J48 — Coinbase API Secured by iExec (Dapp of the Month)
By: Blair Maclennan
Tags: Dapp Of The Week, Blockchain, Ethereum, Crypto, Tech

The application UI: ➡️https://gateway.pinata.cloud/ipfs/QmQ4CY6fSbys5bfAE2nFoKJ5KgXZUEoQeQZv2MnfGFDH3h

We got in touch with him to ask a few questions about his work, so without further ado, here’s @j48 on his Signed Price Feed dapp:

How did you learn about iExec and why were you interested?

I first learned about iExec back in 2017, at which point the ICO mania was in full swing and it was hard to tell which projects were all hype and which had actual promise. iExec originally caught my eye as it seemed similar to folding@home — combining that type of tech with an immutable ledger seemed admirably futuristic. I started following the project more closely after Consensus 2018 when iExec gave a presentation together with Intel about using SGX to protect data. At the time there were few crypto collaborations with big corporations, so this really stood out to me. Since then, I’ve been keeping up with the tech, being genuinely curious to see how it evolves.

Can you give us an insight into any other projects you are working on at the moment?

I’m working on a crypto price analysis dapp running on iExec that will access a private dataset stored on Google BigQuery. It’s currently more of a demo of the tech, since I’m just exploring the possibilities of using iExec to access data on Google BigQuery.

Your application uses the newly released API by Coinbase. What inspired you to use that?

I became intrigued about the potential for signed price feeds to serve as a component of an oracle on Ethereum when I first read Coinbase’s article about their new signed price feed being made available. Current systems are either on-chain rube goldberg complexities or trusted middleware reporting secondhand data from API feeds. Digging deeper into the topic I started reading up on Compound’s Open Oracle system and became impressed with what they were trying to create.

While the signed API data is completely capable of being used in an isolated decentralized oracle deployed on iExec’s sidechain. API results from tasks can also update Open Oracle smart contracts on mainnet since the trust in the signed price feed isn’t lost when the message is relayed to mainnet. The message that stores the data is always a trusted Coinbase price since the signature verifies it was signed by Coinbase’s private key.

Currently, as it’s still in the early stages, there’s only one signed price feed being maintained by Open Oracle smart contracts on mainnet. The need for various entities updating these oracles will become essential as the number of signed APIs grows and the variety of events, data, or prices expands. What’s better than an on-chain median estimated price, calculated from verifiable price data taken from a multitude of only the most-used exchanges?

Why did you choose iExec confidential computing to secure the data?

About a month ago, the SGX-based Kaiko Price Feed dapp was released, inspiring me to try something similar with the Coinbase API. Without TEE, none of this would really be possible, given that the API key would have to be in paintext and visible to all. Using a decentralized cloud provider such as iExec to report signed API data on-chain felt like a perfect combination to me. As the amount of signed API providers grow the need and demand for on-chain updaters increases significantly

You took the interesting approach of encrypting the API key as a dataset within an Intel SGX hardware enclave, can you explain a little more about that?

Encrypting the API key allows for this dapp to run securely on any worker (with SGX) within an TEE workerpool without exposing the actual API key or any of the data. This also allows API providers to take advantage of publishing an encrypted API key on the marketplace without ever publicly revealing the API key, yet still remaining the provider of the data. This avoids giving up control of data they provide to secondhand resellers and eliminates complications where the API results might be sensitive or confidential, also providing them with unique monetization opportunities.