2

I'm really curious about this. If I use Compound CToken function exchangeRateStored() as oracle for my project, is it dangerous? Can someone abuse that? Using flash loan to increase/decrease exchangeRateStored().

1 Answer 1

2
+50

This is a great question - and there are multiple perspectives, so I will try and abstract away some suggestions into "principles".

Depending on usecase, one could argue that when it comes to oracles, "data quality" should be top of mind. When working with oracles, the question to ask is where are the sources of data, how reliable are they, how much coverage they have, what is the aggregation mechanic, risk of skew etc. This ends up separating the issues out -- data generation can be left to off chain providers, and oracles focus on data delivery in a verifiable, tamper resistant way.

Using oracles as a data generation mechanism can be very complicated and open the oracle up to numerous attack surfaces that are common in the defi world, especially if there are "thinly traded"/"shallow" token pools that are susceptible to price manipulation that comes from massive market volume shifts etc.

Using oracles for data delivery is also prone to its issues, most of which can be defended against by having the oracles be decentralized as part of their security design which means that multiple independent oracle nodes have to report on, and aggregate, data before its submitted on chain. This helps make the data delivery piece manipulation resistant, and maintain high availability of the data. This would require that the data is sourced from multiple high quality data providers, and independently fetched, validated and aggregated by a network of decentralized oracles.

These meta principles aside, the way I read the exchangeRateStored() function is that it only uses data on compound and that means limited market coverage for the price of that assets across the market generally. That is more subject to manipulation than multiple, aggregated sources of data.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.