defirisk.co
rubric v1.7.0

Oracle providers used

A oracle & external dependencies factor in the v1.7.0 rubric. Measured per protocol on a s cadence.

Methodology how we score#

What this measures
This factor enumerates the oracle providers used by the protocol — such as Chainlink, Pyth, Redstone, Uniswap TWAP, or in-house custom feeds — listing each provider per asset or market. Data is collected via on-chain reads and protocol documentation. This field serves as the dependency map foundation for the rest of the oracle category.

Why it matters
Oracle provider diversity determines how concentrated a protocol's price-feed risk is. A protocol relying on a single provider for all assets has correlated failure modes: if that provider experiences downtime, data manipulation, or a governance incident, all markets are simultaneously affected. The synthesis dataset documents multiple exploits where thin-liquidity or single-source oracles were the root cause; knowing which providers are in use is the first step in assessing that risk. Protocols that mix aggregated off-chain feeds (Chainlink) with on-chain DEX-derived feeds introduce additional composability surface that must be mapped before downstream factors can be assessed.

Green / Yellow / Red
Green is scored when the protocol uses one or more reputable aggregated providers (Chainlink, Pyth, Redstone) with documented source diversification per asset. Yellow is scored when the provider list is partially documented, includes at least one in-house or DEX-derived feed, or has material gaps between documented and observed on-chain feed calls. Red is scored when no reputable aggregated provider is in use and the oracle source is entirely in-house or spot-DEX derived.

Common gray cases
Gray is applied when on-chain feed calls cannot be attributed to a specific provider (e.g., unverified aggregator contract or proxy with obfuscated source) or when the protocol has not yet listed any assets requiring external pricing.

Notable historical examples
No cross-hacked incidents are currently linked in the database for this factor.

Measurement what to look for#

List all oracle providers used (Chainlink, Pyth, Redstone, Uniswap-TWAP, in-house, etc.) per asset/market pair in the protocol.

Data & output #

Data source
Protocol docs + Etherscan-verified source search for feed address imports + on-chain feed address registry reads
Output format
Green / Yellow / Red
Evidence artifact
JSON map of asset → oracle-provider-slug + feed contract addresses
Confidence signal
green = all assets use established push-oracle providers (Chainlink/Pyth/Redstone) with documented SLAs; yellow = mix of established and DEX-TWAP; red = any asset uses spot DEX price without TWAP; gray = oracle architecture not determinable from source

Scored protocols 0 carry this factor#

No protocols have been scored for this factor yet.

Linked hacks no historical incidents linked#

No historical incidents are linked to this factor.
rubric_version v1.7.0factor RD-F-048category 3carried 0critical no