Oracle risk
A lending market is only as sound as the price it liquidates on. Oracle risk is scored per priced market or asset on a transparent additive 0-100 scale:
score = base risk of the oracle mechanism + penalties for verified problems
Keeping the mechanism and the problems separate matters: a Chainlink feed wired to the wrong asset is a configuration failure, not an indictment of Chainlink, and the score should say so.
Base: the mechanism
Matched against the resolved provider, first hit wins.
| Mechanism | Base | Why |
|---|---|---|
| Hardcoded / constant / fixed 1:1 rate | 55 | Cannot track a depeg by construction |
| Chainlink | 10 | Most battle-tested push feed |
| Price-cap adapter | 10 | A feed bounded by an upper cap — deliberately conservative |
| RedStone, Pyth, Chronicle, Stork, API3 | 18 | Alternative push/pull providers |
| Composite / cross feeds | 22 | Multi-feed composition, more moving parts |
| Rate and redemption adapters (Pendle, Lido, Yearn, Curve, Ondo, …) | 28 | Price is a redemption ratio, not a market quote |
| DEX / TWAP (Uniswap, Aerodrome) | 30 | Manipulation surface |
| Protocol-internal routers (Fluid, Silo) | 18 | Live quotes whose internal feeds are not introspectable |
| Unrecognised provider | 18 | Unknown, not assumed bad |
Flags: verified problems
| Flag | Penalty | Meaning |
|---|---|---|
wrong-asset | +45 | The feed prices a different asset than the market intends |
cross-numeraire | +18 | Denominated in the wrong unit of account |
correlated-proxy | +18 | A capped adapter pricing a correlated asset (e.g. USDe via a capped USDT/USD feed) — over-valuation is bounded, a downside depeg is not |
undecoded-source | +8 | The feed could not be introspected — low confidence, not high risk |
fixed-rate | — | Reported alongside the base of 55 |
Wrong-asset carries the largest penalty because it is the failure that empties a market: the feed keeps returning a healthy, live-looking number while the collateral it is supposed to price does something else entirely.
correlated-proxy is deliberately not treated as wrong-asset. A cap adapter
pointed at a correlated reference is a considered design decision with a bounded
downside, not a misconfiguration.
undecoded-source is a small penalty on purpose. It means our classifier could
not decode the feed, which is a gap in coverage, not evidence of a defect.
Bands
| Score | Band |
|---|---|
| below 25 | LOW |
| 25 to 49 | MEDIUM |
| 50 to 74 | HIGH |
| 75 and above | CRITICAL |
A Chainlink feed on the intended pair lands at 10 (LOW). The same feed wired to the wrong asset in the wrong numeraire lands at 73 (HIGH). A hardcoded rate on an asset that is not actually pegged lands at 55 (HIGH) with no misconfiguration at all — because nothing about it can react to a break.
How it propagates
Oracle ratings are computed per feed and then joined to markets by marketUid,
so they flow into the ratings above them:
- Market rating — the band maps onto the 1-5 scale (LOW 1, MEDIUM 3, HIGH 4, CRITICAL 5) and competes worst-of with governance, collateral and bad-debt signals for that market.
- Vault rating — a vault inherits the oracle risk of the markets it supplies, weighted by allocation, with a materiality override for any risky position above 5% weight. See Vault risk.
- Protocol rating — for isolated-market protocols, the share of markets with an unsound feed contributes to the protocol-level view.
A market whose feed we could not classify is unknown: it does not gain a clean
bill of health, and it does not get marked down as though a defect were found.