Oracle

Blockchains cannot see outside themselves. Every lending protocol, perpetual venue and liquidation engine depends on an external service to report prices, which makes that service part of the protocol's trust model whether or not it is described that way.

Design choices determine the attack surface. A spot price from a single venue is manipulable by anyone who can move that venue's price, which for thin markets can cost far less than the position it unlocks. Time-weighted average prices raise that cost by requiring the manipulation to be sustained. Multi-source medians raise it further.

Update frequency creates the opposite exposure: an oracle that refreshes on a heartbeat or a deviation threshold is stale between updates, and liquidations settle against stale data.

This is why oracle manipulation is a recurring way for protocols to lose funds even when the code is correct. The Mango Markets attack in October 2022, approximately $110MM, involved no bug at all: the attacker moved the price of a thinly traded token on the venue the oracle read, and borrowed against the inflated collateral value. The contract executed exactly as written. Before depositing into any protocol, establish which oracle it reads, how many sources feed it, and what happens if that feed stops.