# Oracle risk

> Scoring the price feed a market liquidates on - mechanism base risk plus verified misconfiguration flags.

Source: https://docs.1delta.io/risk/oracles/

---

A lending market is only as sound as the price it liquidates on. Oracle risk is
scored per priced market or asset on a transparent additive 0-100 scale:

```
score = base risk of the oracle mechanism + penalties for verified problems
```

Keeping the mechanism and the problems separate matters: a Chainlink feed wired
to the wrong asset is a *configuration* failure, not an indictment of Chainlink,
and the score should say so.

---

## Base: the mechanism

Matched against the resolved provider, first hit wins.

| Mechanism | Base | Why |
| --- | --- | --- |
| Hardcoded / constant / fixed 1:1 rate | 55 | Cannot track a depeg by construction |
| Chainlink | 10 | Most battle-tested push feed |
| Price-cap adapter | 10 | A feed bounded by an upper cap — deliberately conservative |
| RedStone, Pyth, Chronicle, Stork, API3 | 18 | Alternative push/pull providers |
| Composite / cross feeds | 22 | Multi-feed composition, more moving parts |
| Rate and redemption adapters (Pendle, Lido, Yearn, Curve, Ondo, …) | 28 | Price is a redemption ratio, not a market quote |
| DEX / TWAP (Uniswap, Aerodrome) | 30 | Manipulation surface |
| Protocol-internal routers (Fluid, Silo) | 18 | Live quotes whose internal feeds are not introspectable |
| Unrecognised provider | 18 | Unknown, not assumed bad |

---

## Flags: verified problems

| Flag | Penalty | Meaning |
| --- | --- | --- |
| `wrong-asset` | +45 | The feed prices a **different asset** than the market intends |
| `cross-numeraire` | +18 | Denominated in the wrong unit of account |
| `correlated-proxy` | +18 | A capped adapter pricing a correlated asset (e.g. USDe via a capped USDT/USD feed) — over-valuation is bounded, a downside depeg is not |
| `undecoded-source` | +8 | The feed could not be introspected — low confidence, not high risk |
| `fixed-rate` | — | Reported alongside the base of 55 |

Wrong-asset carries the largest penalty because it is the failure that empties a
market: the feed keeps returning a healthy, live-looking number while the
collateral it is supposed to price does something else entirely.

`correlated-proxy` is deliberately not treated as wrong-asset. A cap adapter
pointed at a correlated reference is a considered design decision with a bounded
downside, not a misconfiguration.

`undecoded-source` is a small penalty on purpose. It means our classifier could
not decode the feed, which is a gap in coverage, not evidence of a defect.

---

## Bands

| Score | Band |
| --- | --- |
| below 25 | LOW |
| 25 to 49 | MEDIUM |
| 50 to 74 | HIGH |
| 75 and above | CRITICAL |

A Chainlink feed on the intended pair lands at 10 (LOW). The same feed wired to
the wrong asset in the wrong numeraire lands at 73 (HIGH). A hardcoded rate on an
asset that is not actually pegged lands at 55 (HIGH) with no misconfiguration at
all — because nothing about it can react to a break.

---

## How it propagates

Oracle ratings are computed per feed and then joined to markets by `marketUid`,
so they flow into the ratings above them:

- **Market rating** — the band maps onto the 1-5 scale (LOW 1, MEDIUM 3, HIGH 4,
  CRITICAL 5) and competes worst-of with governance, collateral and bad-debt
  signals for that market.
- **Vault rating** — a vault inherits the oracle risk of the markets it supplies,
  weighted by allocation, with a materiality override for any risky position
  above 5% weight. See [Vault risk](https://docs.1delta.io/risk/vaults/).
- **Protocol rating** — for isolated-market protocols, the share of markets with
  an unsound feed contributes to the protocol-level view.

A market whose feed we could not classify is `unknown`: it does not gain a clean
bill of health, and it does not get marked down as though a defect were found.