A blockchain oracle is a service that brings outside data, most often asset prices, onto a blockchain so smart contracts can use it. Blockchains can't fetch that data themselves. DeFi depends on oracles because lending, stablecoins and derivatives all need to know what collateral is worth. If the price is wrong or late, a protocol can liquidate the wrong people or lend real money against worthless collateral.
What is the oracle problem?
The oracle problem is that a blockchain can only agree on data its own nodes can reproduce, and most useful data lives elsewhere.
A blockchain works because every node runs the same steps and gets the same result. If each node called a price API, they would get different answers at different moments and could not agree. So a smart contract can't look up the price of ETH. Someone has to write that price onto the chain first.
That moves the trust rather than removing it. Ethereum's documentation judges oracles on three things: correctness, availability and whether their incentives favor honesty. A single-source oracle offers no way to check its data, and it stops working if the provider goes down.
The stakes are highest in DeFi. A lending protocol uses a price to decide how much you can borrow and when to liquidate you. A bad price can do as much damage as a bug in the protocol's own code.
Push vs. pull: two ways to deliver a price
The main design choice is who puts the price on-chain, and when.
| Push oracle | Pull oracle | |
|---|---|---|
| How it works | The oracle network writes prices on-chain, and contracts read the stored value | A signed price is fetched off-chain and verified when it's needed |
| When it updates | On a price move or a timer | When someone submits an update |
| Examples | Chainlink Data Feeds | Pyth, Chainlink Data Streams |
| Strength | Any contract can simply read it | Can be much fresher, and suits fast markets |
| Weakness | The price can lag between updates | The application must enforce freshness itself |
Neither design is simply better. A slow lending market may be fine with a push feed. A perpetual futures exchange needs prices that move in fractions of a second.
How Chainlink aggregates a price
Chainlink is a decentralized oracle network. Its standard Data Feeds work in these steps:
- Independent operators collect data. Each feed is updated by multiple oracle operators, and each node monitors one or more data providers.
- Nodes combine observations off-chain. Under Offchain Reporting, nodes elect a leader, which gathers signed observations into a report.
- One node transmits. A single transaction carries the report, which saves gas.
- The contract checks it. The aggregator contract verifies that a quorum of nodes signed, then exposes the median value with a timestamp and round ID.
Two triggers start a new round, and whichever comes first wins. The deviation threshold fires when off-chain prices move more than a set percentage from the on-chain value. The heartbeat fires after a set time. These values differ by feed, so a stored price can be somewhat old without anything being wrong.
Using the median means one bad node can't drag the answer far. It doesn't help if the underlying market itself has been moved, which is the weakness attackers go after.
Chainlink also offers a pull product. Data Streams lets apps pull signed reports and verify them on-chain in the same transaction that uses them.
How Pyth differs
Pyth is a pull oracle available on Solana, EVM chains and others. Data providers publish their own prices directly. Then, as its documentation explains, routers compute a median and a confidence interval, a measure of how tightly publishers agree.
Pyth's design changed recently. Its original dedicated chain, Pythnet, shut down in an upgrade that took effect on August 26, 2026. Five routers now sign price aggregates, and Pyth Core contracts accept an update when at least 3 of the 5 signatures verify. So anyone studying an older description of Pyth should check it against the current docs.
Pull designs shift a duty onto developers. Pyth's best practices warn that on-chain verification doesn't check an update's age, so each application must set its own freshness limit.
What a TWAP is and why it resists flash loans
A TWAP, or time-weighted average price, averages a market's price over a window of time and is read directly from a decentralized exchange pool. Uniswap v3 pools keep a running total of the current price tick, so a contract can compare two readings and work out the average between them.
A worked example shows why this helps:
- A pool's price sits at $100, and a contract reads a 30-minute TWAP.
- An attacker pushes the spot price to $150 for one 12-second Ethereum block.
- The contract's average barely moves: about $100.30, since 12 seconds is under 1% of the window.
A contract reading spot price would have seen $150. A flash loan, which must be repaid within one transaction, can't hold a price across blocks at all. To move the TWAP, an attacker must keep the price distorted for many blocks while arbitrage traders push back.
The trade-offs are real. A TWAP lags in a true crash, which can matter more than manipulation. And a thin pool can still be pushed around at a cost an attacker may accept.
How Mango Markets was drained in 2022
The best-known oracle attack involved no broken oracle. On October 11, 2022, Avraham Eisenberg took over $110 million from Mango Markets, a Solana trading platform, according to the CFTC's complaint:
- He opened two accounts and took large, offsetting leveraged positions in a swap tied to the MNGO token's price against USDC.
- He bought MNGO heavily on three exchanges that fed the platform's oracle. The SEC describes MNGO as thinly traded.
- The reported price rose more than 13-fold within 30 minutes.
- He used the paper gains as collateral to borrow and withdraw most of what depositors had supplied.
- The price fell back, leaving the platform with a deficit. He later returned about $67 million.
The SEC put the total at about $116 million. The oracle reported the market price accurately. The flaw was treating a thin market's price as a safe basis for huge borrowing.
The legal outcome is easy to miss. A jury convicted Eisenberg in April 2024, but a federal judge vacated all the convictions on May 23, 2025, mainly because of venue, and also found too little evidence of a false statement on the wire fraud charge.
Five ways oracles fail
Most oracle disasters aren't hacks of the oracle itself. They fall into five patterns:
| Failure | Example | What went wrong |
|---|---|---|
| Thin market moved | Mango Markets, 2022 | A real but easily pushed price was trusted |
| Price formula gamed | Cream Finance, October 2021 | A vault token's price was computed from its on-chain value and supply, and an attacker doubled it, taking over $130 million |
| Single venue | Compound, November 2020 | DAI briefly rose 30% on Coinbase Pro, Compound's oracle source, setting off liquidations |
| Safety limit too rigid | LUNA, May 2022 | Chainlink's LUNA feed held a floor near $0.10 as the market hit $0.01. Venus lost about $11 million and Blizz Finance over $8.3 million |
| Misconfiguration | Aave wstETH, March 2026 | A price cap underpriced wstETH by 2.85%, wrongly liquidating about $26 million |
There is also a blind spot. An oracle reports a price or rate, and it may not notice that an asset's backing has gone. After the April 2026 rsETH bridge exploit, Aave's incident report warned that the rsETH oracle could keep quoting the pre-exploit rate unless Aave changed its feed. Stablecoins and wrapped assets carry a similar risk whenever a feed assumes a fixed value.
How protocols defend themselves
No single defense is enough, so careful protocols layer them:
- Use several sources and a median. This handles one bad node or venue, as in Chainlink's aggregation.
- Avoid thin markets. Chainlink's guidance warns that low liquidity and volume concentrated on one exchange invite manipulation.
- Limit exposure. Supply and borrow caps limit how much of a token a market can take. Lower loan-to-value ratios help too.
- Delay or average prices. A TWAP smooths spikes. MakerDAO built an Oracle Security Module that holds new prices for an hour, giving time to react.
- Reject stale or uncertain prices. Pyth's guidance suggests pausing new activity when the confidence interval is wide relative to the price.
- Add circuit breakers and caps. These pause activity or bound prices in extreme moves.
Every guard has a cost. Delays hurt in a real crash. The floor on LUNA's feed and the cap on wstETH were both safety features that caused harm. So oracle safety comes down to choosing which failure you can live with.
What to check as a user
Before you rely on a protocol, ask four questions:
- Which oracle prices this asset? Protocols with good practices document it.
- How deep is the market behind it? A small token with a high borrow limit is the Mango setup.
- Is the price a market price or a formula? Vault tokens and wrapped assets add a layer that can be gamed.
- What happens when the feed fails? Look for caps, pauses and a clear account of who bears losses.
For more on this topic, see our oracle coverage.
Key takeaways
- Oracles exist because blockchains can't fetch outside data and still reach agreement.
- Push oracles store prices on-chain, while pull oracles deliver signed prices when needed and leave freshness checks to the application.
- Chainlink feeds take a median from multiple operators, and Pyth now signs its aggregates with a set of five routers.
- TWAPs resist one-block price spikes but lag in real crashes and remain weak in thin pools.
- Mango Markets shows that an accurate oracle can still enable a theft if the underlying market is thin.
- Every safety feature can misfire, so strong protocols layer several defenses and limit exposure.
Sources
Get the weekly commit
New blockchain deep dives every week.
