feat: multi-oracle price aggregation with median selection for manipulation resistance

[abayomicornelius]

Summary

The current oracle accepts prices from a single signer. A compromised or manipulated keeper can submit any price they want. Using multiple independent price sources with median selection significantly raises the attack cost.

Proposed Design

• Allow up to N (configurable, default 3) trusted signer addresses per token
• Each execution call includes a price submission from each registered signer
• The oracle computes the median of submitted min prices and median of max prices
• A minimum quorum (e.g., 2-of-3) must submit for the price to be valid

Keeper Protocol Change

Keepers must collect signed prices from all registered signers before calling any execution function.

Acceptance Criteria

• Oracle accepts multiple signers per token
• Median computation is correct for odd and even signer counts
• Execution reverts if fewer than quorum signers submitted
• Single-signer config works as before (no breaking change if N=1)
• Integration test: 3 signers, one submits outlier price — median is used, not outlier
• Unit test: median function with 3, 5, and 2 values

Affected Contracts

oracle, all handler contracts

[ogbesylvester0-gif]

@ogbesylvester0-gif has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hello maintainer I'll like to work on this issue please can you assign me

ℹ️ Repo Maintainers: To accept this application, review their application or assign @ogbesylvester0-gif to this issue.