A smart contract can work out a loan, a liquidation or a swap to the last decimal place. What it cannot do is find out what anything is worth.
That limitation sits beneath every lending app and exchange in decentralised finance (DeFi), and it leads to a question that is easy to skip past: when a lending protocol says the assets you pledged as collateral are worth a certain amount, who told the contract, and why should it believe them?
The answer is an oracle: a service that carries information from the outside world onto a blockchain. Looking at how blockchain oracles work shows why even well-written code relies on data it cannot check for itself, and why “trustless” finance is less straightforward than the label implies.
Why a blockchain cannot just look up a price
Picture a hundred accountants in a locked room, each keeping an identical set of books. The whole point is that every copy matches. Now suppose each accountant may phone a bank for the day’s exchange rate.
One calls at 10:01, another at 10:02, a third is kept on hold. The rates differ slightly, the sums drift apart and the books no longer agree.
That, in simplified form, is why blockchains are built to be closed. On a network such as Ethereum, thousands of independent computers, called nodes, must run the same instructions and arrive at exactly the same result. This property is known as determinism.
A smart contract, which is a program stored and executed on the blockchain, therefore cannot send a live request to a website, because two nodes asking at slightly different moments could receive different answers, and the network would no longer agree on what had happened.
There is a quieter reason too. A node that wants to verify the chain’s history from scratch has to re-run old transactions, and a web request made years ago cannot be replayed with the same answer.
So the room stays locked, and the exchange rate has to be slipped under the door. Someone outside must write the data onto the blockchain, where every node reads the same figure. That someone is the oracle: the fetching happens outside the room, and only the finished answer is let in. Its arrival changes the nature of the risk.
The contract’s logic can be inspected by anyone, but whether the number it has been handed is true cannot be checked from inside the room. This is often called the oracle problem.
Not every on-chain action needs an oracle. Sending tokens between wallets does not, and a typical automated exchange pool sets its price from its own balances. The need appears wherever a protocol must value collateral or settle against a price from outside the chain, as in lending, borrowing and derivatives (contracts whose value tracks an asset’s price).
From one messenger to many: how oracle networks make data harder to fake
The earliest fix was the obvious one: appoint a single messenger. A team ran a server, fetched a price and wrote it to the blockchain at intervals. That worked until the messenger failed, was compromised or was simply wrong, and the contract had no means of telling.
Reading the live price from one trading pool carries the same weakness, because that pool becomes the only witness.
Decentralised oracle networks, of which Chainlink is among the best known, apply the logic of the blockchain to the data itself: replace one witness with many, and let them check one another. Independent node operators each collect an asset’s price from several different data providers.
Their reports are then combined, usually by taking the median, and a single value is recorded on the blockchain for contracts to read. Diversity matters at both levels: the operators should be independent of one another, and so should the data providers they read from.
The median does most of the work. Suppose, purely as an illustration, that five operators report 100, 101, 100, 102 and 40 for the same token, the last because of a technical fault. An average would be dragged down to roughly 89. The median, the middle figure once the numbers are put in order, stays at 100, and nobody had to decide in advance which report was wrong.
The design has a clear threshold. As long as most of the reports are honest, the false ones cannot drag the median outside the range the honest reports cover; to steer the result, an attacker has to corrupt a majority of the operators rather than just one.
Some networks add a financial incentive, asking operators to lock up funds that can be forfeited for misbehaviour or persistent downtime, so that honesty is backed by more than reputation.
The paradox: trustless finance with a trusted data layer
DeFi set out to remove intermediaries. Oracles show that, in one important respect, it ended up rebuilding them. The institution that once set the rate has been replaced by a layer of operators, data providers and design decisions, and users still have to trust that layer, only in a different form.
Consider what sits behind a single price feed. There are the operators who report it and the exchanges and price-data services they read from. There are also the people who chose that feed for the protocol, and in many protocols a governance vote (where token holders decide on changes) or a privileged admin account can later swap it for another.
Each link can be weaker than it appears. If most operators on a feed draw on the same data provider, the apparent crowd is really one witness. If the asset trades thinly, every source can be honest and the number can still be easy to move.
Reading this as a failure would miss the point, though. The difference from the old system is that this trust can be examined. On many networks the list of operators, the update rules and the history of past values are public, which is more than a traditional intermediary usually offers. DeFi did not abolish trust; it made trust something a careful user can see, and then left it to the user to look.
How attackers exploit the gaps in this chain is a separate subject, which we cover in our guide to DeFi oracle attacks.
Where oracles get harder: data that is not a price
Price feeds for major crypto assets are, in a sense, the easy case. Many large markets quote the same asset at the same moment, so there is a crowd of sources to combine, and that crowd is what makes the median work.
DeFi increasingly reaches for data with no such crowd. Tokenised real-world assets, meaning on-chain representations of things such as bonds or commodities, depend on prices from markets that may close overnight or trade only thinly.
Other applications want proof that an issuer really holds the reserves it claims, or an independent confirmation that a condition in an insurance contract has been met. Where there are only a few legitimate sources, the median has less to work with, and the oracle’s reliability leans more heavily on who supplies the data and how it is verified.
The longer-term implication is that the data layer starts to look like financial infrastructure rather than a technical plug-in, and infrastructure of that kind gets judged on its governance, redundancy and track record as well as its code.
For anyone using DeFi, the takeaway is less a checklist than a habit. When an app points to its oracle as a safeguard, ask who stands behind the number and who has the power to change that arrangement. Blockchains solved the problem of agreeing on what happens inside the locked room.
Oracles are the unfinished answer to what is true outside it, and every protocol that relies on one has made a choice about whose word to take.