Pyth Network

Pyth began its permissioned mainnet in August 2021 with a deliberate compromise. Rather than pretend that every wallet could originate institutional market data, it selected publishers close to the source. Each publisher supplied both a price and a confidence interval. The oracle combined several contributions, giving disagreement a visible width instead of hiding it behind a single decimal.

Pythnet launched a year later on the Solana codebase as a dedicated place for that work. In the legacy Core loop, publishers updated SVM accounts each slot and the first update triggered aggregation of the prior slot. The resulting price and confidence lived on Pythnet, ready to travel. Pythnet improved throughput and isolation; it did not make publishers permissionless or turn an aggregate into a warranty.

Legacy cross-chain delivery put each Pythnet slot's Merkle root into Wormhole. Guardians observed and signed it, Hermes paired the signed root with individual price messages and proofs, and a user placed the update inside the same transaction that needed the price. The destination contract checked the guardian signatures and Merkle path before storing the value.

That pull design solved a gas problem by assigning the last mile to demand. It did not outsource judgment. Anyone could submit the authenticated update, yet the integrating protocol still had to reject old publication times, interpret the confidence interval and plan for Hermes or chain delays. A signature answers where a message came from; it cannot decide whether a leveraged market should liquidate against it.

The 2023 token plan fixed the disclosed maximum at 10 billion PYTH. Ecosystem Growth received 52%, Publisher Rewards 22%, Protocol Development 10%, Private Sales 10%, and Community and Launch 6%. Fifteen percent began circulating; 85% was locked for releases 6, 18, 30 and 42 months after launch. Those categories describe intended distribution, not an audited map of every present holder.

A PYTH balance acquires protocol voting power only when staked. Governance runs in seven-day periods at one vote per staked token. The constitution then separates broad holder votes from delegated operations: eight elected Pythian councillors use a 7-of-9 multisig with an Operations Wallet for upgrades, fees, validator resources and OIS settings, while seven Price Feed councillors use 5-of-8 for feed and publisher choices.

This division makes token governance real but bounded. Stakers can elect councils and decide proposals; council keys execute recurring authority. A data consumer needs neither an allocation nor a ballot to submit a valid update. Conversely, owning a ballot does not convey publisher data, shares in Douro Labs or Pyth Data Association, or a promise that Hermes will remain free and anonymous.

Oracle Integrity Staking opened a second use for PYTH in September 2024. A publisher could put unlocked tokens behind its own pool, and other holders could delegate to a chosen publisher. When a qualifying misprint lasted at least 60 seconds, diverged by at least 250 basis points under normal markets and escaped the confidence warning, the Pythian Council could identify responsible pools and apply a proportional slash up to 5% under the DAO rulebook.

The mechanism is accountability, not a policy sold to every borrower. Slashed tokens pass under DAO control; reimbursement requires a later choice rather than arising automatically. The incentive also changed. OP-PIP-103 set the reward rate to zero on 22 April 2026, so publishers and delegators accrue no current OIS rewards or delegation fees even though their assigned stake can still be slashed.

The August 2026 upgrade replaced the center of the old diagram. Five independently operated Pyth Pro routers now compute aggregates, sign Merkle roots and send them to upgraded Hermes. Destination contracts accept three of five signatures. Pythnet root production and Wormhole's 13-of-19 guardian quorum moved from current Core architecture into its history, while the ABI and payload shape stayed compatible.

Compatibility required power. The DAO upgraded supported existing contracts in place at 16:00 UTC on 26 August; Sui consumers had to swap manually. Older EVM source shows why an ownerless proxy was never an immutable proxy: authenticated governance messages could replace the implementation, valid data sources, fee, validity period and Wormhole address. The current migration exercised that broader governance path at product scale.

Hermes also began requiring an API key. The consumer now meets three separate institutions: publishers or routers create and sign data, Hermes serves it, and governance defines the verifier and its authorities. PYTH reaches the third through stake and councils, and OIS reaches some publisher behavior through slashable collateral. Neither route grants the holder the feed itself. The interface stayed; the trust map had to be redrawn.