× 
Oracle / external dependencies
Every protocol depends on systems it does not run, such as oracles, bridges, keeper networks, and programs invoked via CPI. These controls require that each dependency be mapped, its failure bounded, and its liveness monitored.
Dependency mapping enumerates every external system the protocol relies on and states what each is trusted to do. The controls in the rest of this pillar can only be applied to dependencies the team has written down.
All external dependencies are enumerated, including oracles, bridges, keeper networks, programs invoked via CPI, and off-chain data sources. Explicit trust assumptions are documented for each.
For every dependency, the failure modes are specified, covering what happens if it lies, goes stale, or disappears.
Trust boundaries are drawn, distinguishing what the protocol verifies from what it assumes to be correct.
Oracle manipulation is a routine attack on DeFi protocols. Resistance comes from independent sources, a documented aggregation method, and deviation bounds enforced on-chain rather than from trust in any single provider.
Price feeds use multiple independent sources where feasible.
The aggregation method is documented, whether median, TWAP, or weighted average.
Confidence intervals or deviation thresholds are enforced on-chain.
Known threat vectors for the protocol’s oracle architecture are identified and mitigated.
The oracle selection rationale is documented, covering why this provider, for this asset, at this update frequency.
A price feed that stops updating keeps reporting its last value, and the protocol keeps acting on it. Every external input needs an enforced maximum age and a specified behavior for when fresh data stops arriving.
The maximum acceptable age for every external input is defined and enforced on-chain.
Fallback behavior when inputs are stale or unavailable is specified.
Liveness monitoring is in place for every critical external input.
Containment limits what any single dependency failure can cost. Per-market oracle assignment, bridge deposit limits, and per-collateral exposure caps keep one bad feed or one drained bridge from cascading through the whole protocol.
No single failure can unnecessarily drain the protocol.
Exposure per external dependency is capped or isolated, for example through per-market oracle assignment, bridge deposit limits, or maximum exposure per collateral type.