Architecture Overview

Data Flow

1. Fetch — The enclave requests the SUI/USD price from CoinGecko's API
2. Sign — The enclave signs the price and timestamp with its secp256k1 private key
3. Submit — You (or a bot) submit the signed payload to the Sui blockchain
4. Verify — The Move contract verifies the signature against the registered enclave's public key
5. Store — If valid, the price is written to on-chain history

Project Structure

sui-oyster-demo/
├── contracts/
│   ├── EnclaveRegistry/   # Pre-deployed enclave key registry (dependency)
│   │   ├── sources/
│   │   │   └── enclave_registry.move
│   │   └── Move.toml
│   ├── Demo/              # Sui Move oracle contract
│   │   ├── sources/
│   │   │   └── oyster_demo.move
│   │   ├── tests/
│   │   │   └── oyster_demo_tests.move
│   │   └── Move.toml
│   └── script/            # Helper scripts
│       ├── register_enclave.sh
│       ├── update_price.sh
│       ├── get_price.sh
│       └── get_registry_pcrs.sh
├── enclave_rust/           # Rust enclave implementation
├── enclave_node/           # Node.js enclave implementation
├── enclave_python/         # Python enclave implementation
└── nix.sh                  # Reproducible build script

Components

Enclave Application

A secp256k1 keypair is generated when the enclave starts up (the private key never leaves the enclave). The enclave runs a simple HTTP server that:

• Exposes /health endpoint for health checks
• Exposes /price endpoint that fetches from CoinGecko, signs the result, and returns the signed payload
• Exposes /public-key endpoint for retrieving the enclave's public key

The /attestation/hex endpoint for retrieving the attestation document is provided by the enclave services.

You can implement the enclave in Rust, Node.js, or Python - pick whichever you're comfortable with.

Enclave Registry (Pre-deployed)

The enclave registry is a shared, application-independent contract already deployed on-chain. It stores enclave public keys (secp256k1 and x25519) and their PCR values. You register your enclave in this registry — you do not need to deploy it yourself.

Demo Contract (User-deployed)

The oracle application contract handles:

• Signature verification — Validates that price updates come from registered enclaves
• PCR matching — Checks enclave PCR values against expected values configured by the admin
• Price storage — Maintains historical price data with timestamps

Both contracts use enclave verification primitives inspired by Nautilus.

PCR Values

Platform Configuration Registers (PCRs) are hashes that identify what's running in the enclave. When using the blue enclave image (Oyster's default), the PCR values are structured as follows:

PCR	What it verifies
PCR0	Enclave image (kernel + OS)
PCR1	Kernel and boot parameters
PCR2	Blue image setup
PCR16	Application code and setup

When you register an enclave on-chain, you commit to specific PCR values. The contract will only accept signatures from enclaves with matching PCRs. For more details on how PCR values work with the blue image, see verifying attestations.