# The Blockchain Oracle Problem in Decentralized Finance--A Multivocal Approach
## 5 Risks and Attack Vectors
### Malfunctions (T)  
Being software (or hardware-based), oracles may suffer from bugs or malfunction. A solution to this problem is to periodically check the status of oracles and undertake tests and maintenance [23]. The Synthetic issue that happened in 2019 [117] constitutes a clear example of malfunction. As previously explained, the Synthetic platform is a specialized DeFi that allows users to be exposed to the price of assets that do not typically belong to the world of cryptocurrencies (e.g., fiat currencies SEVR). By the time of the incident, the platform relied on an aggregate price derived from a set of off-chain oracles that was updated on-chain at fixed intervals. The users of the platform could then speculate over the supported assets by using long and short positions. The system worked very similar to common trading platforms, such as eToro or Plus500, but exploited decentralization provided by blockchain [8]. On 25 June 2019, however, one of the systems of off-chain oracles on which Synthetic relied for the price of Korean Won (sKRV), misreported the price to be 1000 times higher than the actual rate. To prevent misrepresentation of price feeds given by outliers, the Synthetic platform performed a mean value between the price feeds; however, for sKRV, they could only rely on two oracles. Supposing that at least one of the oracles was performing correctly, the mean between two values was, in any case, not sufficient to outweigh the error. The misreported price was then accepted by the system and exploited by a bot specifically programmed for spotting price anomalies. The bot performed multiple transactions for a total turnover of over one billion dollars. Luckily, the platform was able to identify the proprietary of the bot, which was not a malevolent operator, and used the bot only for ordinary trading procedures. He agreed then to return the money in exchange for a so-called \"bug bounty\" (reward for spotting bugs before they harm other users or the platform itself). In the end, it is arguable that two main factors created the problem. First, the scarcity of price feeds, and second, a malfunction or tampering of one of the oracles.  
Another interesting example of oracle malfunction is the MakerDAO Black Swan Incident [118]. The outcome was very similar to the previous Compound example, which witnessed an important amount of collateral liquidated due to unexpected price change. However, in the MakerDAO incident, the problem originated with an unforeseen event (COVID-19 Crisis) that made cryptocurrency prices fall unexpectedly. The price of ETH fell from $200 to roughly $80 in a matter of hours. This generated two unparalleled consequences. First, the vaults were under-collateralized, and that obliged users to return some DAI or to fund the vault with more ETH to balance with the loss value. Second, the market congestion made transaction fees explode, also slowing the time of settlements. So, most users were unable to access their vaults and save their collaterals. Meanwhile, oracles were unable to update prices timely, and this made it possible for some bots and users to liquidate vaults nearly for free. The total amount of assets siphoned from the Maker vault exceeded eight million dollars. Brilliantly explained by Eskandari et al. [63], the issue, in this case, was that the oracle contract had a predetermined (and fixed) amount of fees to spend for price updates. Due to the congestion then (and the higher price of fees), every price-updating transaction failed. When the price of fees matched again those predetermined in the oracle contracts, the reported price was then too different from the previous one, creating a \"jump\" in the ETH price. This caused the liquidation of collaterals in the MakerDAO vault. From an oracle perspective, this event is interesting because even if the oracle contract correctly reported the price, the time of update created an unprecedented discrepancy in the ETH price, making the timeliness of transactions another critical characteristic to take into account [119; 120].