Unit 4 · Level 3 · The DeFi risk stack
Oracle risk & flash loans
A lending protocol can't see the world; it learns prices from an oracle, a data feed. Trick the feed and you trick the vault: make the protocol believe your collateral is worth 10× reality, borrow against the fantasy, and walk away. Flash loans make it far worse, because anyone can borrow millions with zero collateral as long as it's repaid within the same transaction. Whale-sized ammunition, rentable by the second.
Free to play. No ads, no token, no account needed to start.
What you get asked
In DeFi, what is an oracle?
Contracts are blind; oracles are their eyes. Which means the eyes are exactly where an attacker aims.
Reconstruct a classic oracle-manipulation attack:
All five steps fit inside one transaction. Mango Markets lost roughly $110M to a price-manipulation attack like this in October 2022.
Why do flash loans make these attacks so much easier?
Manipulating a market used to require being rich. Flash loans rent 'rich' for a few seconds. The attack either profits or the whole transaction reverts, costing the attacker almost nothing to try.
Oracle attacks work best against ___ markets, where prices are easy to shove around.
Pushing the price of a deep, liquid market costs a fortune; pushing a tiny pool costs pocket change. Attackers hunt for protocols that price collateral off puddles.
What actually defends a protocol against oracle manipulation?
Averaging over time makes a one-second spike worthless, and deep sources make spikes expensive to create. When researching a protocol, 'which oracle?' is a question worth asking every time. 🐜
The rest of this unit
Code, oracles, and admin keys: the risks stacked under every APY.