feat: add oracle price deviation bound to resolution path

[Vvictor-commits]

Closes #554

---

Summary

Adds a configurable price deviation guard to the oracle validation path. A Reflector (or any oracle) price that moves beyond a configured percentage from the last accepted reading is rejected before it can influence market resolution — closing a key oracle manipulation vector.

Changes

types.rs

• Added max_deviation_bps: Option<u32> to GlobalOracleValidationConfig and EventOracleValidationConfig
• None disables the check (fully backward-compatible)

oracles.rs — OracleValidationConfigManager

• validate_oracle_data now runs a deviation check after staleness/confidence:
  • Loads the last accepted reference price from persistent storage (key: ("ORC_REF", market_id))
  • First reading: no reference → accepted and stored immediately
  • Subsequent readings: deviation_bps = abs(price - ref) * 10_000 / ref; if > max_deviation_bps → Err(OracleNoConsensus) + oracle_validation_failed event with reason price_deviation_exceeded
  • Reference is updated only on acceptance
• Added get_reference_price helper (used by tests)
• validate_config_values rejects max_deviation_bps = 0 or > 10_000
• Removed "temporarily disabled" stubs from set_global_config / set_event_config

lib.rs

• set_oracle_val_cfg_global and set_oracle_val_cfg_event accept new max_deviation_bps: Option<u32> param and call through to OracleValidationConfigManager
• get_oracle_val_cfg_effective returns live config instead of hardcoded defaults

Tests (6 new, inline in oracles.rs)

Test	Covers
test_deviation_first_reading_accepted_and_stored	No reference → accepted, reference stored
test_deviation_within_bound_accepted	3% move with 5% bound → ok
test_deviation_exactly_at_bound_accepted	Exactly 5% with 5% bound → ok (not strictly greater)
test_deviation_spike_beyond_bound_rejected	20% spike with 5% bound → OracleNoConsensus + event
test_deviation_disabled_when_none	max_deviation_bps: None → 50% move passes
test_deviation_per_event_override	Per-event 2% bound overrides global None

Run tests

cargo test -p predictify-hybrid -- oracle

[drips-wave]

@Vvictor-commits Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits