Blockchain Oracles: A Bridge Between Worlds – Chainlink, Goracle and Beyond

Blockchain Oracles are an essential element in the world of decentralized applications and smart contracts. External “off-chain” data is often required for decentralized networks and smart contracts to work, however, they cannot directly access this data themselves. For example, a smart contract deployed for a decentralized exchange cannot look up the ETH/BTC price on a liquid centralized exchange and use it as a settlement price for swaps. The solution to that problem is a blockchain Oracle.

What is a Crypto Oracle?

Blockchain Oracles are third-party services, that provide smart contracts with external data or information from the off-chain world to Blockchains. While providing the rails for blockchains to interact with outside-of-the-network data, they also function as aggregators and validators. This ensures the data is accurate, verifiable, and comes from a diverse range of sources. Better data means a more stable and credible ecosystem of decentralized applications (Dapps) for users to interact with.

Chainlink, currently the world’s largest Oracle network, has enabled US$7,767,337,766,991 worth of value to be transacted. The protocol has 980+ Oracle networks, representing the total number of Chainlink nodes running on the network. Chainlink has 8.1 billion ‘data points’ – this is the total amount of data delivered by Chainlink nodes to smart contracts across all the blockchains supported by Chainlink.

Oracles are also required to transmit data from physical sources like camera motion sensors or RFID readers which may operate within an Internet-of-Things (IOT) architecture. Physical assets like art or shoes can be tracked on the blockchain with hardware Oracles. Sensor-based Oracles can be used to track unique items within physical supply chains for this data to then be printed onto immutable blockchains.

Beyond price feeds, the potential use cases for external data across Dapps is extensive with many different applications for Oracles, including;

• Information on “real world” assets (loans, collateral, funds, equity) for financing protocols
• Information to power insurance protocols – e.g., confirming damage verification
• Results of sporting and political events to resolve prediction markets
• Weather data to determine insurance premiums and payouts

How Do Oracles Work?

The basic design of a blockchain Oracle requires that data is first collected from a non-blockchain source. Then a signed message is used to send the data on-chain. The data is then made accessible to applications by storing and enabling it in a smart contract.

The data from the Oracle smart contracts is stored, so that it may be accessed by message requests from agreed users that invoke the ‘retrieve’ function.

There are “immediate-read” smart contracts that provide quick and simple information like event results, or answers to a simple “yes-or-no” question. Another type of Oracle data is “Publish-Subscribe” which is data that is likely to update frequently and change often. This can be Oracle price feeds, weather data, or traffic data. This type of data needs to be subscribed so that it can be frequently called.

An Oracle Example

Brave New Coin’s (BNC) crypto data engine itself is accessible to smart contract developers to readily integrate and utilize BNC’s crypto spot price Oracles across a variety of blockchain platforms.

BNC works by providing a fair price for any tracked digital asset from near real-time trading across a global network of top crypto exchanges. With intraday, end-of-day price, and volume inputs updated at a 30-second tick interval, developers in decentralized finance can plug into BNC to build trustless applications using an independent, reliable, third-party price discovery Oracle.

Node operators and Oracle providers that use BNC data include;

• LinkPool
• Blocksize Capital
• B-Harvest
• DexTrac
• AlphaChain
• Simply VC
• Mycelium
• Infinity Stone (aka InfStone)

Oracle Security – Vulnerabilities Exist

While Oracles have offered avenues for decentralized applications to launch data dependent products and services, they are not without their risks. Oracles can fail because of a variety of factors including direct exploits and market manipulation.

Mango Markets – A Price Manipulation Exploit

In October 2022, Mango Markets, a Solana-based derivatives market, was left reeling after an attacker caused the price of a token, reported by an Oracle, to skyrocket.

The Mango Markets exploiter first funded two different crypto wallets with US$5 million worth of USDC. Wallet 1 initially put in a sell-order totaling US$483 million worth of perpetual futures at a price of US$0.38. Perpetual futures (or swaps) are synthetic margin trading instruments that have no expiry and operationally work as a never-ending series of 8-hour futures contracts. At the end of every 8 hours, the contract holder is paid or charged an interest rate on the price difference between the price listed on the contract and the spot price at the time. For decentralized exchanges to determine the market spot price, an Oracle needs to be used.

Additionally, perpetual swaps allow for margin trading. A trader can open a position by putting up a reduced amount of collateral, which acts as a security for borrowed funds. This can magnify wins, or lead to spiraling losses.

Then, wallet 2 purchased the sell order put up by the first wallet at a price of US$0.0382. At this time the exploiter then started buying MNGO at spot prices from multiple exchanges including Mango Markets, AscendEX, and FTX. This pushed the price of MNGO up to US$0.91.

The attackers then moved funds between wallets 1 and 2, the funds ended up on wallet 2 where there were now huge unrealized profits. Mango was a cross-trading and loan platform, a practice where buy and sell orders for the same asset are offset without recording the trade on the exchange. This meant that the unrealized profit from the trade could be used as collateral for a new loan. The funds from wallet 2 were then used to acquire a loan for US$116 million in the form of stablecoins and liquid assets.

Eventually, the price of MNGO dropped to below US$0.03 but the loan had already been withdrawn and the counterparty was left with collateral worth peanuts. The exploiter was able to use a little over US$10 million to get US$116 million from Mango Markets. This is an example of a market manipulation hack. No software was compromised and all Oracles and decentralized applications worked as they were supposed to.

BonqDAO – A Bug Exploit

On February 2nd 2023, Polygon-based Defi protocol BonqDAO fell victim to a different type of Oracle hack. The BonqDAO attack involved an Oracle exploit due to an error in a smart contract. This was a direct Oracle exploit that occurs when an Oracle reports inaccurate data from the external world.

The exploit stemmed from a bug in the price feed smart contract of BonqDAO. BonqDAO was using a price feed from the Tellor Oracle protocol and then using it to report a price. The bug allowed the hacker to artificially change the price of Wrapped AllianceBlock Token, this token was then used to borrow US$100 million worth of BEUR stablecoin. BEUR could be minted directly from the Bonq protocol with deposited tokens.

Source: Openchain.xyz

The above lines of code from Openchai.xyz displays transaction data which reveals that the ‘updatePrice’ function had been used to boost the price of ALBT tokens. This is a function that generally cannot be arbitrarily changed without a higher level of access permission than a general user.

In the end, after using the ALBT to mint BEUR tokens, the attacker rushed to swap tokens while there was still liquidity on Uniswap. They were able to sell 2 million BEUR for USDC, DAI, WETH, and WMATIC. They were then able to siphon some of these funds through Tornado.cash.

This attack was different from the Mango Markets exploits. A bug, that likely should have been picked up by a more thorough internal review or audit, was live in the wild. It is a lesson to other deployers of Oracle-dependent smart contacts.

The Goracle Oracle

Abdul Osman, the CEO of Goracle, an emerging Blockchain Oracle provider, says the BonqDAO theft “highlights the issue with prices not being final, as well as node operators choosing where they get the price from. By mandating the data sources node operators must use, multiple, independent operators can cross-check the values are correct, therefore allowing the data to be final.”

Goracle is a decentralized blockchain Oracle solution built on the Algorand blockchain. It provides a secure and reliable way for smart contracts on the Algorand blockchain to access off-chain data. With the new cross-chain compatibility feature, Goracle can import data from Ethereum and other blockchains, opening up new use cases and opportunities for developers.

Goracle’s features enable Algorand to act as a settlement layer for other blockchains, providing seamless access to data on other chains and facilitating cross-chain liquidity. This feature will enable developers to build a wide range of applications without building their own centralized Oracles. For example, developers can now build DeFi apps that allow users to trade assets across multiple blockchains.

Other use cases for cross-chain applications include supply chain management, gaming, and asset management. For example, developers can build applications that track the movement of goods across different blockchains, verify the ownership of virtual assets in games, or manage a portfolio of assets across different blockchains.

Goracle is conducting an IDO for its $GORA token on June 28 via Tokensoft and featured on a recent Crypto Conversation podcast.

Oracle Economics

To explain the functionality of Oracle tokens and the internal economics of Oracle ecosystems, Chainlink’s LINK token is a good template. An ERC-20 token, LINK powers the Chainlink network, with the additional ERC-223 “transfer and call” functionality, allowing tokens to be received and processed by contracts within a single transaction. The LINK token is used to pay Chainlink Node operators for the retrieval of data from off-chain data feeds, formatting of data into blockchain readable formats, and off-chain computation. Chainlink Node operators act as validators of the Blockchain network and their number has continued to grow steadily since Chainlink’s launch.

The decentralized network has three approaches for preventing faulty data and reducing single Oracle vulnerabilities. Data sent through the network is curated and verified through majority voting, which prevents a single point of failure in the Oracle system.

The network also cycles through Oracles and introduces a reputation and certification system for Oracle performance. Hardware components also protect the integrity and confidentiality of data to ensure tamper-proof and private data transfers between Oracles and smart contracts.

Node operators set aside a stake that is locked to the network; if they act dishonestly this stake is ‘slashed’ and removed from their ownership. This LINK is then distributed to honest validators.

Chainlink Staking v0.1 was launched on December 6th, 2022. This initial release of Chainlink Staking allows LINK token holders to stake their tokens in order to earn rewards for securing the Chainlink Network. To participate in Chainlink Staking v0.1, LINK token holders needed to create a Chainlink staking account. Once they created an account, they could then stake their LINK tokens by depositing them into the staking contract. Stakers can unstake their tokens at any time, but they will forfeit any rewards that they have earned for the current staking period.

Other Oracle networks like Band Protocol and Oraichain have similar models where tokens primarily act as rewards for stakers who secure the network and as a way to settle transaction fees.

Staking also offered a new level of participation for non-node-operating users of the Chainlink network. The staking model allows non-node-operating LINK holders to allocate their stake to delegators and earn a passive reward. LINK paid out as stake comes from fee-paying users of Chainlink price feeds and the Chainlink treasury reserve. Eventually, as Chainlink grows, staking rewards will be paid entirely through price-feed transaction fees.

Chainlink’s model is also designed with a reframed reputation framework. Nodes that consistently provide quick and accurate responses to data requests will be preferred over less consistent ones. When there are too many fast, reliable node operators to choose from, Chainlink will then look at other metrics, including how much stake a node operator holds to determine whether they should be assigned a task.

Stakers will likely assign their stakes to validators who are more reliable and less likely to be slashed. These nodes should stand out amongst fast and reliable validators because they have a higher stake, this feedback loop is designed to compete in a competitive secure network. Even if a node is not assigned a task, staking rewards that incentivize the securing of the network create a steady passive income.

Oracle Tokenomics

Tokenomics is a key conundrum for any sort of blockchain protocol with a token to solve. When launching a token a protocol has to determine —

• How much of the initial supply should go to founders, the community, liquidity providers, and other stakeholders
• An emission schedule. Is the asset inflationary, does it have a burn model and what is the supply?
• How much should miners or validators be rewarded?
• Methods of distribution like airdrops or grants
• How to allocate revenue (like transaction fees). Who gets these? Is it users, service providers?
• Should there be a treasury and if so what should it be used for?
• Does the token or coin play a role in governance?
• Usage of internal tokens like LINK or external tokens like ETH or USDC within the protocol.

The aim of a token-based economic model is to create an efficient self-sustaining machine/network where common goods are naturally generated and ensure that key value creators have satisfactory rewards.

One of the key focuses of the new Chainlink model is incentive design. If all nodes have a high reputation, stake matters, this creates a reason for nodes to potentially buy and lock-up LINK. This creates reduced selling and a more stable Chainlink economy, which rewards high-reputation nodes who commit to the ecosystem with stake. LINK supply dilution is also reduced because of the stake delegation model, with users and other stakeholders of Chainlink assigning stake to node operators.

A new paradigm in Oracle token design is arriving to the market on June 28th. GORA is the native token of Goracle, a decentralized blockchain Oracle protocol aimed at elevating Web3 to mainstream exposure through infrastructure and deeper community participation in data reporting.

The GORA token has been designed to encourage holders to engage with the platform. For example, GORA holders can take part in important decisions, stake in Goracle, contribute as a node runner, pay for data/computation as a consumer, and obtain value from the network effects of increasing the usage of Goracle. GORA will also be used to pay for data products within the Goracle protocol.

The incentive driver of the GORA token is community and user participation and subsequently decentralization and security through network adoption. It adapts elements similar to Chainlink’s staking to push for similar results. Goracle abstracts away the complexity of running a node, incentivizes large numbers of non-related participants to secure the network, and separates the roles of data providers, and node operators.

Speaking to GORA’s tokenomics, Abdul Osman says incentive design is notoriously difficult “especially in an environment where there is much to gain from a successful attack. One idea is that the incentives should outweigh the gains from any attack. Or, the punishment from a successful or attempted attack should also outweigh the possible gains from an attack.”

Conclusion

Blockchain Oracles represent a paradigm shift in the convergence of the physical and digital world, extending blockchain’s reach to include many real-world use cases including the integration of the Internet-of-Things (IoT), financial systems, insurance protocols, weather, and much more.

This considered, implementing Oracles requires robust infrastructure with aligned incentives, proper auditing, and potential failsafes. Incidents such as the Mango Markets exploit and the BonqDAO attack highlight the inherent vulnerabilities in Oracle systems and their potential repercussions.

Nevertheless, there are numerous powerful Oracles functioning functioning today, powering a variety of decentralized finance applications. The success and growth of Chainlink demonstrate this. The project has further secured its network through an internal staking system and reputation framework that rewards users and keeps bad actors in check.

Innovations like Goracle’s GORA token applications are set to bring about a novel paradigm in Oracle token design, and will likely further bolster user participation and network adoption. It feels as though we may only be at the tipping point of the Oracle-infused blockchain landscape, as our digital and physical realities continue to intertwine more intricately than ever before.