Oracles for a real-world asset: pricing what is off-chain

Graduate · enrolled learners

This lesson opens with Synthetix oracle incident, June 2019.

What happened

Synthetix was a protocol that let users hold synthetic assets tracking the prices of real-world things, currencies, commodities, and it relied on price oracles, feeds that bring off-chain prices on-chain, to know what those assets were worth. In June 2019 one of the commercial price APIs behind its feeds began intermittently reporting the Korean won at about a thousand times its true rate; the oracle had a mechanism for discarding outliers, but an earlier unnoticed outage had left only two sources serving that price, so it averaged the bad one in, and the protocol trusted the result completely. A trading bot noticed and did what the system's rules allowed: it rapidly traded against the mispriced feed, and in less than an hour made over a billion dollars in profit, entirely on paper, generated by the protocol's own logic pricing an asset at a thousand times its worth. Alerted by its community, Synthetix stopped the oracle, which halted all trading and transfers, and the bot's owner agreed to reverse the trades in exchange for a bug bounty, so the recorded loss is zero, but the event was a near miss of extraordinary scale. The protocol had no market to sanity-check the price against; it trusted the oracle, the oracle was wrong, and the on-chain logic acted on the wrong number at machine speed.

The decision point

An oracle is the mechanism by which an off-chain price enters an on-chain system, and it is a complete trust point: the on-chain logic has no independent knowledge of what a real-world asset is worth, so it acts on whatever the oracle reports, correctly if the oracle is right and catastrophically if it is wrong. This matters acutely for a tokenized real-world asset, because a real-world asset has no continuous on-chain market price the way a liquid crypto token does, so its value must be supplied by an oracle, and the on-chain system will price, lend against, and redeem the asset on that oracle's number with no market to check it. Synthetix is the case: a single bad feed priced an asset at a thousand times its value, and the protocol's own logic generated a billion dollars against it before a human intervened. A stale, thin, single-source, or manipulable oracle is therefore not a peripheral risk but a direct one, because it is exploited automatically and at machine speed the moment it is wrong. So the decision when tokenizing a real-world asset is to design the oracle that prices it for robustness, multiple independent sources, resistance to manipulation and staleness, and sanity bounds, and to recognize that the oracle is a governance decision as important as the valuation itself, because the on-chain system trusts the oracle completely and will act on a wrong price exactly as faithfully as a right one, as Synthetix's logic minted a billion dollars against a thousand-fold error.

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.