Spool DeFi Insights: Who watches the watchmen? The challenges of Oracles in DeFi
DeFi is an incredible new financial system. Fully automated and decentralised smart contracts allow a range of traditional, and brand new, financial services to develop and be open to a wider population than ever before. However, nothing exists in a fully closed system and DeFi solutions need a means of gathering their external data in an automated manner. That is where Oracles come into play as they provide the data a DeFi solution needs to operate.
Unfortunately, in the automated world of DeFi, Oracles have proven an easily accessible vector for an attack. If you can change the figures a protocol is using, you can change the results of what it gives out without any need to target the highly secure blockchain architecture the DeFi protocol is built on.
In this piece, we’ll cover how Oracles work, how they most commonly get attacked, and how the wider DeFi space is dealing with these challenges as it moves forwards to wider adoption at scale.
What is an “Oracle”?
Simply, an Oracle is a source of off-chain data for a smart contract to read and take as input. Most commonly this is used to provide pricing data for cryptocurrencies. While each individual transaction on a given blockchain, such as Ethereum, is held on-chain and is permanently visible, the price of that asset relative to another fiat or cryptocurrency is not.
Oracles can, theoretically, be used to provide any source of data from a trusted source into a smart contract, be that floor price data of a digital asset such as an NFT series, or real-world sporting event scores. Oracles can also be used to provide data from smart contracts that other DeFi protocols can then access in turn. This could be the results of a particular investment strategy within a protocol, or the liquidity in a specific pool, for example.
The key is that Oracles are a form of trusted data, it is fed directly into automated code, and is subject to the risks associated with trusted models.
Why are Oracles a risk?
The risk around Oracles came primarily from their off-chain centralised nature as a source of truth which is fed directly into smart contracts. As DeFi evolved, there were initially fewer reference points for Oracles to pass data to the smart contracts. For example, if a DeFi protocol looked at the price of cryptocurrency X vs Y, there may have been only one or two sources for those prices. In very simple terms, an attacker could artificially increase or decrease one of them temporarily to alter the information the Oracle was sending, and therefore the way the DeFi protocol was operating.
As the smart contracts are fully automated and data is normally live, particularly with the rise of “flash loans” where large sums can be loaned to be repaid back in minutes, this led to an increase in attacks in this manner. Cheese Bank was one such DeFi project who suffered due to a flash loan attack on its Oracles in November 2020. In this instance, attacks were run against their collateral price on Uniswap. This allowed attackers to drain over $3 million in USDC, USDT and DAI by altering the relative price of the ETH/Cheese pool.
How have Oracles evolved to reduce risk?
While Oracles are still a vector for attack, their risk has, over time, been considerably reduced. For cryptocurrency information, such as pricing, a key reducer of risk has been the increasing liquidity of exchanges and liquidity providers. While increasing liquidity is an indirect prevention method for Oracle attacks, it does increase the risk and requirements of the attacker to affect the source data to the required level successfully.
The way Oracles are utilised has also been improved as the wider DeFi ecosystem has continued to grow. Whereas early Oracles could only rely on a single, or low number of sources, Oracles for modern DeFi projects are able to pull data from a much wider set in a decentralised manner. The principle is that multiple independent sources are used with outliers, such as those being manipulated, potentially being ignored.
While, in theory, this prevents attacks against a single source, Oracles run in this manner are still susceptible to problems relating to collusion among sources. Should an attacker perform a “man-in-the-middle” attack, where the oracle itself is directly attacked through a code flaw, for example, these preventative measures will also fail. As Oracles sit outside the blockchain architecture they lack the security and censorship-resistant nature of on-chain data, making this a genuine risk.
The most successful method, so far, to prevent Oracles attacks is, in some ways the least ideal among the decentralised proponents of web3. That is the creation of dedicated Oracle service providers who ensure a quality of service and data.
Specialists such as Chainlink, Compound Finance, and Band Protocol provide decentralised Oracle data and feeds, allowing DeFi developers to concentrate on securing their own smart contracts once that data is received and leaving the security of the feed, and accuracy of the source data, to the dedicated provider. These products have proven highly successful in both providing accurate and timely data feeds, as well as secure tamper-resistant models for DeFi developers looking for a safer solution.
What does the future hold for DeFi Oracles?
Oracles will continue to be critical for DeFi as the ecosystem evolves, but will also continue to be a vector for attack.
In particular, we are likely to see an increase in non-DeFi-related real-world Oracles coming to the fore. Anything from TradFi pricing of assets, sporting event scores, and even the weather could be fed through Oracles. Potentially any aspect of the real world that is trackable and measurable could move into the DeFi space and be used as a basis for DeFi investments. How these are handled, both from the source data and through the code of the Oracles themselves will be key to the success of projects as they test the water on these new products.
As one of our key goals at Spool is to continually improve risk analysis and DeFi users’ understanding of investment risks, we will certainly continue to watch closely as Oracles develop and their usage is refined.
______________________
Spool is a permissionless DeFi platform that connects Capital Aggregators with DeFi Yield Generators. Funds are dynamically and efficiently allocated to ensure optimized yields, for custom strategies, managed by DAO-curated Risk Models.
Spool was established as a DAO, with a selection of founding contributors representing a diverse cross-section of the blockchain community.
Stay tuned as we shine a spotlight onto more Spool Team members over the coming weeks.
Website | Telegram Ann | Twitter | Medium | Discord
