Oracle risk
The contract calculates right - with a wrong figure
What can happen
The contract itself is flawless. It does exactly what it should. The only thing wrong is what it was told.
| The source is wrong | The service the figure comes from delivers a wrong value or none at all. If it fails, the last known one often stays put - and at some point that is no longer true. |
|---|---|
| The market is distorted | If the price comes from a trading venue, it can be moved there for a moment. Anyone who moves enough capital briefly creates a wrong price for exactly the duration of one transaction. |
| The figure is stale | A price from twenty minutes ago looks like a fresh one. In a quiet market that makes no difference; in a falling one it does. |
How that turns into a financial loss
The loss does not arise from the wrong price but from what the contract then does automatically.
In a lending protocol, liquidations hang on it. A price reported too low sells collateral that would have been enough - the borrower loses it for no reason. One reported too high leaves loans standing that are long since uncovered; when that comes out later, the money is missing from all depositors together.
In a swap protocol, the rate hangs on it. Whoever swaps at a distorted price gives up more than they get - and the counterparty is the person who created the distortion.
A documented case
DOCUMENTED CASEMango Markets, October 2022
What is notable about it is that it presupposes no weakness in the code of the attacked contract. What is attacked is the assumption that the price queried is dependable.
A related pattern needs no capital of its own: within a single transaction a very large sum is borrowed, the price moved with it, the distorted value used and the borrowed sum returned in the same operation. Because it all runs in one operation, there is no moment at which anyone could step in.
Can this be the subject of a cover?
In principle yes - but less often expressly than smart contract risk.
The reason is attribution. The loss arises in the protocol, triggered by a figure from outside. A wording that covers flaws “in the smart contract” may not capture it - because the contract worked correctly.
Whether the oracle is covered too therefore has to be stated expressly.
What the wording has to answer
| Is the price feed covered too? | Is the oracle named in the wording, or only “the contract”? Without express mention the case is open. |
|---|---|
| Which oracle exactly? | A protocol can use several sources, a different one per market. What is covered is then not the price feed but one particular feed. |
| Does a distortion count as the event? | Some wordings require an error or a failure. A price that was briefly real because somebody moved the market is neither. |
| Does a failure count as the event? | The oracle delivers nothing and the contract carries on with a stale value - covered or excluded? |
| Who determines that the value was wrong? | And against what? A comparison with which other price, at what moment? |