The leaks · 48 / 86
Oracles
A contract cannot see the outside world by itself. An oracle is the feed that tells it a price. If the feed lies, the contract acts on the lie, and people lose deposits.
Where the price comes from
A single exchange, a handful of reporters, or a median of many markets. A thin market is easy to push for a moment. That moment can be enough to liquidate borrowers or drain a pool.
The check
Ask which markets the feed uses, and what happens if one of them breaks. A protocol that prices itself from its own tiny pool is marking its own homework.
You do not need to build the lie. You need to see that the price is an input someone can shove.
Check yourself
Is the price inside a contract the same as a deep global market?
Only if the oracle actually reads a deep market. Sometimes it does not.
After this you can ask where a protocol gets its price, and what a one-minute lie would do.
Previous: Admin keys and upgradeable contracts · Next: Exploit patterns