Oracle Risks in DeFi
Oracles feed external data (prices, events) to smart contracts. Most DeFi protocols depend on oracles, making oracle security essential to understand.
What Are Oracles?
Oracles bridge blockchains and the external world. Smart contracts cannot access off-chain data directly. Oracles provide this connection.
Common Uses
Price Feeds: Asset prices for lending, liquidations, derivatives. Randomness: Verifiable random numbers for games, NFTs. Events: Real-world outcomes for prediction markets.How Price Oracles Work
Chainlink Model
- Multiple independent nodes fetch prices from exchanges
- Nodes submit updates on-chain
- Aggregator computes median/weighted average
- Protocols read the aggregated price
DEX-Based Oracles (TWAPs)
- Track prices from on-chain DEX pools
- Calculate Time-Weighted Average Price
- Resistant to flash loan manipulation
- May lag during volatility
Oracle Attack Vectors
Price Manipulation
Flash Loan Attacks: Borrow to manipulate DEX prices, exploit protocols using that price, repay in same transaction. Spot Price Exploitation: Protocols using instantaneous DEX prices are vulnerable.Oracle Failures
Stale Prices: Oracle fails to update, protocol uses outdated price. Incorrect Prices: Bug or attack causes wrong price feed. Single Source Failure: Reliance on single oracle creates single point of failure.Historical Exploits
Mango Markets ($114M): Manipulated MNGO price on low-liquidity markets. Harvest Finance ($34M): Flash loan manipulated Curve pool price. Cream Finance (Multiple): Several exploits involved oracle manipulation.Evaluating Oracle Security
Key Questions
- Which oracle does the protocol use?
- How many sources feed the oracle?
- What is the update frequency?
- Are there circuit breakers?
- How are oracle changes governed?
Red Flags
- Spot DEX prices without TWAP
- Single oracle source
- No timelock on oracle changes
- Low-liquidity collateral assets
Protecting Yourself
Before depositing:
- Check which oracle the protocol uses
- Verify oracle source reliability
- Understand what happens if oracle fails
During volatility:
- Monitor positions closely
- Consider exiting risky positions
- Maintain conservative collateral ratios
Major Oracle Providers
Chainlink: Most battle-tested, wide coverage. Pyth: High-frequency, first-party exchange data. Uniswap TWAP: Fully on-chain, no external dependencies.FAQ
What is the safest oracle?Chainlink is most battle-tested. Multi-oracle setups with fallbacks are ideal.
How do flash loan oracle attacks work?Attacker borrows to manipulate price, exploits protocol, repays. All in one transaction.
How can I check a protocol oracle?Read documentation, check contracts, or review audit reports.
Related Topics
Explore: [smart contract risks](/insights/learn/smart-contract-risks), [MEV protection](/insights/learn/mev-protection), [DeFi insurance](/insights/learn/defi-insurance).
Understand protocol risks. Fensory provides risk context for DeFi opportunities.[Explore DeFi Safely →](https://www.fensory.com)