A Three-Month High With No Timestamp: The Provenance Gap in Machine-Readable Markets

Tesla. Share price. Three-month high. Up 5.5%. Attribution: Gate market data.

That is the entire dispatch. Four claims, one of them a source label, none of them anchored to a coordinate in time or a value in dollars. I have audited smart contracts with more verifiable state than this sentence. The contract at least commits to a storage slot and a block number; this headline commits to nothing.

I have spent sixteen years watching this industry argue about whether code is law, and eleven of those years actually reading the code. The lesson I keep relearning is not that bad data exists. Markets have always been full of bad data. The lesson is that a claim which is directionally correct and numerically unverifiable is more dangerous than a claim that is simply wrong, because wrong data gets rejected at the door and unverifiable data gets forwarded, aggregated, and eventually consumed by an automaton that has no capacity for skepticism. This dispatch is directionally correct. Tesla almost certainly did trade higher on some day in some week. That is precisely the problem. Nothing about it can be falsified, and an object that cannot be falsified cannot be audited.

So I did what I do with any unverified feed. I treated it as an interface and probed its return values.

The Inversion: How a Crypto Venue Became a Window Onto the Nasdaq

The provenance line reads "Gate market data." Gate, formerly Gate.io, is a cryptocurrency exchange. It is not a consolidated tape. It is not a primary listing venue for US equities. It is not a registered securities information processor. It is a venue that built its reputation, correctly, on the transparency properties of on-chain settlement, and that has since appended a market-data surface covering instruments it does not custody, does not clear, and does not settle.

This is not a scandal. It is an architectural detail with consequences, and almost nobody prices those consequences.

Consider the inversion. For most of the last decade, the crypto industry's central rhetorical claim was that centralized market infrastructure was opaque — that the consolidated tape was a privilege granted to a licensed few, that settlement was a T+2 fiction sustained by counterparty trust, that retail saw prices seconds after the desks did. The industry's answer was a public ledger where every trade is a state transition and every state transition is permanent. Then the same industry started publishing equity quotes scraped from third-party endpoints and labeling them with the venue's own name.

The venue's name is doing work it has not earned. When a reader sees "Gate market data" attached to a Tesla print, the implicit transfer of credibility is enormous and completely undocumented. The reader's brain performs a substitution: this exchange has real-time API access to everything, therefore it has real-time API access to this. In practice, the equity feed behind a crypto venue's market page is, at best, a licensed redistribution of a consolidated feed, and at worst a scrape of a public web endpoint with a refresh interval nobody publishes.

I have written about this pattern in another register — the way protocols borrow credibility from their dependencies without inheriting their guarantees. A rollup that posts to Ethereum inherits Ethereum's data availability only under specific conditions that must be documented and tested. A crypto exchange that displays a stock price inherits the stock exchange's price integrity only under conditions that are, in this case, not merely undocumented but almost certainly absent.

The direction of the claim — up, at a multi-month high — is plausibly correct. The precision of the claim — 5.5%, three-plus months — has no verifiable lineage. Those are two different epistemic objects sharing one sentence, and the sentence does not distinguish between them. A downstream consumer cannot separate the part it should trust from the part it should not.

That is the structural defect. Everything below is its consequence.

What "Three-Month High" Actually Computes

The phrase looks like an observation. It is not. It is a computation over a stateful window, and like any windowed computation it requires you to specify the window, the sampling function, and the aggregation rule — none of which appear in the dispatch.

Strip it down. To assert that a price is at a three-month high you need: a reference timestamp for "now"; a lookback boundary of roughly ninety days; a definition of what constitutes a valid observation within that window (closing price? intraday last? volume-weighted? does it include pre-market and after-hours prints?); a rule for handling non-trading days, halts, and holidays; and a comparison operator. Six parameters. The dispatch supplies zero.

The interesting part is what happens when you try to compute this on-chain, because that exercise exposes exactly why the off-chain version is so sloppy.

A naive on-chain implementation needs a ring buffer of ninety daily closes. Writing ninety values into storage is not free. A cold SSTORE to a fresh slot costs 20,000 gas; a warm update costs 5,000, and a zero-to-nonzero transition costs 22,100 in the worst case. Even under the most charitable accounting — ninety warm updates at 5,000 gas — you are looking at 450,000 gas per full window rotation, before you touch the comparison logic or the read path. In a market where a simple swap costs 120,000 gas, maintaining a rolling ninety-day price history is a meaningful fraction of a block's useful capacity, and it buys you nothing unless someone is willing to pay for it.

So nobody does it on-chain. They compute the window off-chain, sign the result, and post the signature. Which is fine — until you notice that the entire trust model of the claim has migrated from "verifiable computation over public state" to "a server said so, with a timestamp we hope is honest." The three-month high is not a fact about the chain. It is an assertion by an operator, dressed in the grammar of a fact.

There is a further problem, and it is the one that actually bites. A rolling-window maximum is a non-monotonic function of its inputs. It can decrease. If the lookback boundary advances by one day and a high print drops out of the window, yesterday's "three-month high" can become today's "not a three-month high" without any change in the current price at all. An assertion of this type has an implicit expiry measured in the granularity of its window, and the dispatch publishes neither the window nor the expiry. A reader who consumes this line six hours later has no way of knowing whether it still holds. A reader who consumes it six days later is consuming a claim that may have silently inverted.

Contrast this with how the same industry handles a much simpler object: a Chainlink-style aggregator round. That round carries a roundId, an updatedAt, and an answeredInRound. It has an explicit heartbeat — an interval beyond which the answer is declared stale and consumers are expected to revert. The staleness window is a published parameter. You can disagree with its value; you cannot claim it does not exist. The equity dispatch has no heartbeat, no round identifier, and no staleness bound. It is an oracle response with the metadata stripped off.

Four Missing Fields, Four Failure Modes

The dispatch omits a time anchor, an absolute price, a comparison baseline, and an attribution. In my line of work, each of those omissions has a name, a canonical exploit, and a documented loss.

Field One: The Time Anchor

"Three-month high" is a relative judgment requiring two coordinates: the present and the lookback origin. Neither is given. There is no timestamp on the sentence, no timezone, no session marker.

In oracle code, this is the missing updatedAt check, and it is the single most common defect I find in consumer contracts. The canonical form looks like this: a protocol reads latestRoundData(), extracts the answer from the tuple, and discards the other four return values. The feed is live, the answer is a number, the transaction succeeds. Then the underlying aggregator goes down for maintenance, the answer freezes at its last value, and the protocol continues to mint, liquidate, and price collateral against a number that stopped describing reality hours ago. The protocol is not broken. It is faithfully reading a stale truth.

I have watched this exact pattern produce liquidations that should not have happened and borrows that should not have been permitted. The failure is never in the feed. It is always in the consumer that treated a point-in-time snapshot as a continuous truth.

A headline without a timestamp is the same object. It is a snapshot with an unbounded validity claim. The reader supplies the assumption that it is current, because human readers default to recency. That default is exactly the assumption an adversary exploits.

Field Two: The Absolute Value

Only the delta is published. Five point five percent. The base is withheld.

This is not pedantry. A percentage change without a denominator is not a quantity; it is a shape. It tells you the direction and the steepness of a move, and nothing about the mass behind it. A 5.5% move on a heavily traded mega-cap and a 5.5% move on a thin, wide-spread instrument are entirely different events in terms of liquidity consumed, positioning unwound, and information revealed.

In contract terms, this is the decimals problem, and it is embarrassingly common. An aggregator returns an integer with a decimals() accessor. A consumer hardcodes eight decimals because that is what the first feed it integrated used. Six months later someone swaps the feed for one with eighteen decimals and the protocol is suddenly valuing collateral at ten billion times its actual worth, or one hundred-millionth of it, depending on the direction of the error. The integer was correct. The interpretation was wrong. The integer was never the price; the integer plus its scale was the price, and the consumer only read half the object.

A delta without a base is an integer without its decimals: technically present, semantically incomplete, and silently catastrophic when it propagates into a decision.

Field Three: The Baseline

"Up 5.5%" — relative to what? Previous close? Intraday reference? A rolling VWAP? Does it include the pre-market session, where the liquidity is a fraction of the regular session and the prints are correspondingly less meaningful? The dispatch does not say, and the difference matters enormously to anyone doing arithmetic on it.

There is a deeper version of this defect. Denominators are where most accounting fraud lives, and they are also where most honest confusion lives, because the choice of baseline is almost never neutral. Change the baseline and you change the sign of the result. A stock can be up 5.5% on the day, down 12% on the week, and flat on the quarter, and all three statements can be simultaneously true and simultaneously presented as the headline. This is not dishonesty. It is selection, and selection is the cheapest form of manipulation ever invented, requiring no false statement at all.

In protocol terms, the baseline is the reference price in a TWAP, and the choice of window determines whether an attacker's manipulation is diluted or amplified. A short window is cheap to move. A long window is expensive to move but slow to react. Every oracle design is a negotiation between those two failure modes, and the negotiation is documented, argued over, and parameterized. The equity dispatch performs the same negotiation implicitly and publishes none of it.

Field Four: The Attribution

The dispatch offers zero causal information. No earnings, no delivery figures, no policy action, no sector news, no index correlation. The reader cannot distinguish an idiosyncratic move from a beta move.

This is the difference between alpha and beta, and it is the difference between a signal about a company and a signal about the market. A stock up 5.5% while its entire sector is up 6% is underperforming. A stock up 5.5% while its sector is flat is doing something. Same number, opposite interpretation, and the dispatch cannot tell you which world you are in.

There is a crypto-native version of this failure that I have written about before, and it is worth restating precisely: the front-runners are already inside the block. By the time a one-line dispatch reaches a retail reader, the information it contains has been arbitraged by every participant with a faster feed, a colocated server, or a direct license to the consolidated tape. The 5.5% is not new information to them. It is the residue of a move they already positioned for. The headline's function is not to inform; it is to recruit late liquidity into a trade that has already happened. Attribution would reveal this, because attribution would show that the move was driven by a macro print affecting two hundred names, not by anything specific to the company. Without attribution, the reader defaults to a narrative about the company, which is precisely the wrong inference and precisely the profitable one for whoever is distributing the headline.

The Consumer Contract That Would Have Caught It

Here is the naive integration. I have seen this exact code in production, in protocols holding nine figures, more than once.