FlySure: The Oracle That Merged Two Codeshare Legs
FlySure is a Bermuda-incorporated insurer selling parametric flight-delay cover through a smart contract on a public EVM chain. The policy pays 0.5 ETH automatically if the oracle reports an arrival delay of 240 minutes or more. The policy terms, hashed and stored on-chain, state: 'The Oracle Report is the sole and conclusive evidence of delay; payments executed by the Contract are final and irreversible.' On 4 February the oracle, which consumes a single commercial flight-status API, reported a 310-minute delay for flight QF812 and paid out 0.5 ETH to 830 policyholders (total 415 ETH). The airline later confirmed the aircraft actually arrived 95 minutes late; the API had merged two codeshare legs. FlySure wants the money back and has frozen the claims pool. One policyholder, a market maker holding 40 policies, has threatened to sue for bad-faith denial if FlySure withholds future payouts. Governing law clause: 'laws of Bermuda'; no arbitration clause.
1. Analyse whether FlySure can recover the 415 ETH. Address contract, restitution, and practical recovery separately.
Read the worked answer
Contract first. Recovery is not the starting point; liability is. If the policy validly makes the oracle report conclusive, then on the terms the insured event occurred and the payment discharged FlySure's obligation. A payment made in performance of a valid obligation is not recoverable as a mistake - there is no enrichment 'without basis' where the contract supplies the basis.
Restitution. Unjust enrichment claims generally fail where a valid contract governs the same subject matter. The argument would have to be that the payment was made under a mistake going to liability rather than to the amount, or that the conclusive-evidence clause is unenforceable. Neither is strong here.
Fraud or manipulation. If the oracle operator was manipulated or the API was knowingly misconfigured, there may be a claim - but against the oracle provider under its service contract, not against 830 retail policyholders.
Practical recovery. On-chain transfers to 830 dispersed wallets are functionally unrecoverable. Even where holders are identifiable (the market maker), litigation costs dwarf 40 × 0.5 ETH. The realistic recovery route is the oracle vendor's SLA and indemnity, plus any professional indemnity cover FlySure holds.
The freeze is the bigger risk. Withholding payouts on unrelated, validly triggered claims is a likely breach and hands the market maker a clean bad-faith claim. Release the pool, ring-fence the disputed 415 ETH as a provision, and pursue the vendor.
2. How should a court be expected to construe 'sole and conclusive evidence' and 'final and irreversible', and does code execution equal performance?
Read the worked answer
Construction. The clause is an agreed evidential provision. Courts tend to enforce clear exclusive-evidence clauses between commercial parties, but three limits matter:
- Contra proferentem: FlySure drafted the clause, so ambiguity in 'sole and conclusive' is read against it. Was the 'Oracle Report' the report as generated, or as validly generated?
- Main purpose: a clause that would allow a payout on a manifestly wrong data feed may be read down where it defeats the commercial purpose of a delay policy.
- Ouster: the clause does not and cannot oust the court's jurisdiction or displace mandatory consumer-protection rules in the policyholder's home state.
'Final and irreversible'. This most naturally describes technical settlement finality - the transfer cannot be reversed on-chain. It is a statement about the ledger, not a waiver of contractual or restitutionary claims. Conflating the two is the classic error.
Code execution and performance. Automated execution is a mode of performance, not a substitute for the contractual condition. If the condition is defined by reference to the oracle report, then the condition was satisfied as defined and FlySure performed. If it is defined by reference to actual delay, code execution may have discharged nothing.
So the whole case turns on drafting: which fact is the operative condition? The words 'sole and conclusive evidence of delay' point strongly to the report. That is bad news for FlySure and the reason the clause needs rewriting.
3. Recommend the redesign: oracle architecture, contract drafting, and immediate handling of the market maker.
Read the worked answer
Oracle architecture
- Dual or triple independent sources (airline O&D feed, airport authority, ADS-B derived) with a reconciliation rule: pay only when at least two agree, otherwise route to an adjudication path.
- Flight-leg identity keyed on marketing and operating carrier plus date and airport pair, to prevent codeshare merging.
- A short challenge window (for example, 24 hours) before payout, with a bonded disputant role.
- Data-provenance warranties and liquidated damages in the oracle vendor contract.
Drafting
- Replace 'sole and conclusive' with a rebuttable presumption plus an obvious-error correction clause.
- Add a set-off and clawback right against future claims by the same holder.
- Add governing law, an arbitration seat, and a class-action/aggregation clause.
- State expressly whether execution of the smart contract discharges the obligation.
- Size the treasury for the tail: 830 concurrent triggers is a solvency event, not an edge case.
The market maker
- Release its valid claims immediately and in writing; do not bundle it with the dispute.
- Offer a without-prejudice discussion on the 40 disputed policies only, and keep the offer clearly severable.
- Document that withholding was a control decision, not a coverage denial, so the bad-faith allegation loses its factual base.
A regulator reading this file will ask one question: did you have a written policy for oracle error before the event? Have the answer ready.