A decentralized satellite oracle network
Verifiable satellite imagery for smart contracts.
Smart contracts can request, verify, and consume real satellite imagery with a cryptographic chain of provenance back to the source. No single operator to trust.
Iris is a peer-to-peer network built in Rust on libp2p. When a
smart contract needs an image of a specific place at a specific time — to settle a
parametric insurance claim, verify carbon credits, or check what's on the ground at a port —
Iris coordinates a committee of independent nodes to fetch that imagery from commercial
providers, agree on a single representative image through Byzantine-fault-tolerant
consensus, and seal the result on-chain with a threshold signature. Every
link in that chain of provenance back to the original satellite provider is
cryptographically auditable.
Provenance
The chain of provenance
Eight links, from the satellite provider's API to the on-chain output — each one independently checkable.
Text description of this diagram
The chain starts when a Data Provider's API serves an image over TLS. That TLS session runs inside a trusted execution
environment, and the enclave produces a TEE Remote Attestation proving the code that
fetched the image is the code that's supposed to be running. From there, every
node-to-node message is authenticated over libp2p using Noise encryption and each
node's ed25519 PeerId. The selected image is fingerprinted with a BLAKE2b content hash
and pinned to IPFS for durable retrieval. The committee seals the result with a BLS
threshold signature, and the on-chain IrisVerifier contract
checks that signature before recording the output. No single link in the chain has to
be taken on faith.
Iris does not synthesize a composite image.
A round produces a medoid — the existing image, from one specific Regular Node, that's most similar to everything else submitted for that round. It's a real, downloadable GeoTIFF with an unbroken TEE-attested TLS provenance proof back to a Data Provider. Nothing about it is blended, averaged, or generated — the verifiability story collapses if it were.
A Requester posts a
DataRequest; a committee of Regular Nodes
fetches the imagery; a per-round Leader Node aggregates the submissions, runs a normalization pipeline, and selects the
medoid; the committee signs a threshold BLS signature over
the result; a Relayer
delivers the signed report to the on-chain IrisVerifier.
More than ⌊2n/3⌋ of the committee's members must sign for a result to be valid. The leader role rotates every round and earns no extra fee. Relayers can censor a request but cannot forge a result — an on-chain timeout provides a fallback if one goes quiet.
Walk through the full round on the How It Works page.
Parametric insurance
DataRequest for the affected polygon at
the storm's timestamp.
Carbon credit verification
Supply chain & commodity attestation
DePIN & geospatial dApps
vs. centralized GIS APIs
Verifiability. The on-chain output carries a cryptographic chain to the TLS handshake with the original Data Provider, attested by hardware-rooted TEE keys — not a claim you have to take a single vendor's word for.
vs. existing oracle networks
Payload type. Iris handles 0.5–16 GB GeoTIFFs, not scalar price feeds.