How a Contract Learns the Price of Anything

Last month a friend watched a lending position get liquidated at 11:47 on a Tuesday morning. ETH was trading around $2,410 on every exchange he checked. The liquidation bot, following the protocol’s own rules, closed him out at an oracle price of $2,180 that had been sitting in the contract since the night before. He was right about the market and wrong about the number the market was allowed to see. That gap has a name, and it holds up most of decentralized finance.

The World the Chain Cannot See

A blockchain is a machine that agrees on facts. Every node runs the same computation and reaches the same answer, which is exactly what makes a smart contract trustworthy and exactly what makes it blind. A contract cannot fetch a website. It cannot ask Coinbase what ETH is worth right now. Any outside fact has to be carried in and signed for, and the piece of infrastructure that carries it is called an oracle. The Oracle problem is the oldest puzzle in the field: how does a system that trusts nothing decide whom to trust about the weather, the price of oil, or this afternoon’s exchange rate.

How a Price Feed Actually Works

A price feed is a signed opinion with a quorum. Take Chainlink’s data feeds, which secure the majority of DeFi lending. A set of independent node operators pulls prices from a list of exchanges and data providers, aggregates them off chain, and submits the result on chain. The feed takes the median of the submissions, so one lying node cannot move the number. On Ethereum mainnet the ETH/USD feed updates whenever the price moves about 0.5 percent and at least once an hour even if nothing happens. That second clause is called the heartbeat, and my friend’s liquidation happened because 0.5 percent is a wide band when the market is jumping.

The history here is short and instructive. The first on-chain price feeds were just the spot price of a decentralized exchange’s own pool, which is a bit like valuing your house at whatever the last buyer paid in your driveway. MakerDAO built its own oracle system around 2017 for exactly this reason, Chainlink launched in 2019 and turned “signed median of many sources” into the default, and every lending market since has inherited the design.

What Goes Wrong

Oracle failures come in three flavors, and the third is the interesting one.

Stale data: the feed stops updating while the market runs away. Thin markets: the sources agree because they are all quoting the same illiquid pair. Then there is the attack where the oracle is honest and the market is fake. In October 2022 a trader borrowed a fortune of MNGE tokens, pushed the token’s price up on a thin Mango Markets market that the oracle was watching, and walked out with roughly $114 million in what he openly called a “highly profitable trading strategy.” The feed did its job. It faithfully reported the price of a market that was being bent.

Reading a Feed Like an Operator

Before trusting any protocol with size, I check four things. Who runs the nodes and how many of them there are. Which exchanges feed the aggregation and whether any of them can dominate it. What the heartbeat and deviation threshold are, in writing. And whether the deployment has a sequencer uptime feed, the Layer 2 add-on that freezes the price during an L2 outage instead of reporting a stale one as fresh. Arbitrum and Optimism deployments all carry one, and a lending market without it is one bad hour from a liquidation wave.

The contract my friend trusted was answering the only question it could ask: what did the agreed-upon feed say at block time. Everything that went wrong lived in the plumbing between the world and the feed. When a protocol advertises its security, look at that plumbing first. The math on chain is the safe part.