Crypto’s data oracles are a hidden vulnerability

Oracles of risk

The data oracles, the automated feeds that provide vital price data to smart contracts and enable trading on blockchains, are drawing increased scrutiny over their roles in recent hacks and the vulnerabilities the industry’s reliance on them creates. They are also attracting more investment from VCs and bigger crypto players who see an opportunity amid this fear.

The crucial role oracles play in crypto came a day after two hacks this month: a $114 million hack of Solana trading service Mango Markets and a smaller attack on Moola Market, both involving oracle price manipulation.

• Oracles bring off-chain data to blockchains so they can work. Blockchains cannot execute or record trades without the market prices provided by oracles. They’re a critical piece of infrastructure, in other words, though it’s rare for anyone but smart contract developers to consider their value or dig into their vulnerabilities.
• Many DeFi protocols rely on Chainlink, an open source technology, to provide pricing. Founded in 2017, Chainlink uses a network of interconnected oracles to provide 60% to 90% of market data across all of DeFi, according to Sergey Nazarov, co-founder of Chainlink Labs. This year, it has helped process more than $6.4 trillion in transactions, he said.
• Chainlink started on Ethereum but is now on more than 15 blockchains. It is also looking to expand its approach to other fields such as insurance and blockchain gaming.

There is a growing interest in alternative oracles. That’s despite — or perhaps because of — Chainlink’s ubiquity.

• Binance launched a native oracle service last week for its BNB Smart Chain, taking internally a system that had previously run on Chainlink, the largest oracle provider.
• API3 and Flux claim to be more decentralized than Chainlink. While Chainlink’s oracles are dispersed among various nodes, their selection is still controlled by Chainlink, said Dave Connor, co-founder and head of business development at API3, which is trying to solve this by managing its oracles with a DAO.
• Nazarov said ChainLink feeds are “decentralized at the data source, oracle node, and oracle network level,” meaning they have “strong protection against downtime and tampering.”

This debate between efficiency and decentralization is common in crypto. “The reality is that over time everything becomes more centralized,” said Boris Wertz, who invests in crypto at Version One Ventures, citing bitcoin mining and ether staking as examples.

• Some insiders say that having one large vendor or a small number of vendors supporting the industry poses a risk to a new industry like crypto. “I think that’s why there’s a lot of venture money going after alternatives,” said Shawn Douglass, CEO of Amberdata, which supplies data to Oracle Networks.
• It’s always a “good news, bad news” debate when a major player in a category does well, Wertz said. “Obviously, that player is most likely stronger in terms of security and scale than others. At the same time, if it is manipulated, many people will be affected.”
• Nazarov said Chainlink’s size isn’t a risk, because it’s open source and can be customized to be as secure as developers want it to be.

People disagree about how responsible oracles were for the Mango Markets attack and other events. But even if an oracle is correct, the way it’s used can pose “very significant risk,” said Austin Campbell, head of portfolio management at crypto infrastructure firm Paxos. Such debates are likely to continue. As institutional players get deeper into crypto and regulators dig in, critical parts of the infrastructure like oracles are sure to come under more scrutiny. Oracles can know things that are not on the blockchain. But their ultimate test may come in knowing themselves.

– Tomio Geron (e-mail | twitter)

A version of this story first appeared on Protocol.com. Read it here.

A MESSAGE FROM THE FINANCIAL TECHNOLOGY ASSOCIATION

The news is out! Join the Financial Technology Association’s first Fintech Summit: Shaping the Future of Finance, produced in partnership with Protocol. Taking place in Washington, DC on November 16, the summit will examine the most pressing issues in fintech.

Read more and book your place here.

On the money

Credit card debt is back at pre-pandemic levels. Total card balances in the US reached $916 billion in September, returning to December 2019 levels after balances fell sharply during the first months of the pandemic.

Hong Kong released a new policy statement on crypto. In a bid to shore up its fading status as a global financial hub, the autonomous region’s government said on Monday it would seek “risk-based handrails” to regulate virtual assets.

Senator Elizabeth Warren wants stricter Zelle rules. The senator sent a letter to the Consumer Financial Protection Bureau calling for rules to stamp out fraud on the payment platform.

“Buy now, pay later” pushes Gen Z into debt. Pay later offers have attracted young consumers with poor credit history, who saw it as an alternative to credit cards for the TikTok generation.

Binance is working on blockchain applications for Twitter. The crypto exchange backed Elon Musk’s Twitter purchase with $500 million. Now that the deal has gone through, there is a co-investor with Musk.

Overheard

SEC commissioner Horses “I’m Not Your Crypto Mom” ​​Peirce advises caution when it comes to NFTs. “I think the SEC has provided very little clarity,” she told Decrypt. “There is a lot of uncertainty. And in situations where there’s so much ambiguity, I think people really have to be very careful. This is not the ideal state.”

Coming up

NFT San Francisco takes place Monday at the SF Jazz Center. Panels delve into NFTs and music, film, gaming and consulting.