The blindness is deliberate. Every node must reach the same answer when it re-runs a transaction, so contracts are not allowed to call the open internet, where two nodes might receive two different replies a second apart. An oracle solves this by writing the data on-chain first, as an ordinary transaction, after which every node reads the identical value.
Designs differ mainly in how much trust they demand. The simplest is a single publisher posting figures from its own server, which is cheap and fast and completely dependent on that publisher staying honest and online. Sturdier designs collect quotes from many independent reporters and combine them, often taking a median so one bad submission cannot swing the result, with penalties for reporters who stray. Lending markets, derivatives and any asset holding a <a href="/glossary/peg/">peg</a> lean on these feeds constantly, as does most of <a href="/category/defi-smart-contracts/">DeFi</a>.
Oracle manipulation is one of the most reliable ways protocols have been drained. If a contract reads its price from a single on-chain <a href="/glossary/liquidity-pool/">liquidity pool</a>, an attacker can borrow a large sum, shove that pool far away from the real market price for one block, borrow or trigger liquidations against the distorted figure, then unwind, sometimes in a single transaction. The defences are well understood: multiple independent sources, time-weighted averages rather than spot readings, sanity bounds and circuit breakers. Wherever a protocol quotes a price, it is worth knowing where that number came from, because the oracle is often the weakest joint in the structure.
Key takeaways
- Blockchains are sealed by design, so every external fact a contract uses was put there by someone in a transaction.
- The real question is not whether an oracle works but who can influence its number and how quickly they can do it.
- Prices taken from a single on-chain pool are the classic manipulation target, while averaged multi-source feeds are much harder to bend.
Oracle — frequently asked questions
Why can't a smart contract just fetch a price from a website?
Because every node validates the same transaction independently and must reach an identical result. If each node fetched the page itself, they could get different answers seconds apart and the network would never agree on the outcome. Publishing the value on-chain first turns it into fixed, shared data that every node can re-run and confirm in exactly the same way.
What does an oracle attack look like in practice?
An attacker deliberately distorts the source a protocol reads. Typically that means using borrowed funds to move a thin on-chain market for a moment, so the protocol values collateral far too high or too low, then borrowing against it or forcing liquidations at the wrong price. The contract behaved correctly throughout; it was simply fed a false number.
New to crypto, or filling in the gaps? Work through the essentials in Learn, browse every term A–Z, or see live prices for the coins these concepts power.