> For the complete documentation index, see [llms.txt](https://delpho.gitbook.io/delpho-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://delpho.gitbook.io/delpho-docs/risk/oracle-risk.md).

# Oracle risk

Delpho depends on price feeds for collateral valuation, liquidation triggers, and rebalancing logic. Oracle accuracy is therefore a core dependency. A stale or manipulated feed can mis-price collateral, mis-trigger liquidations, or cause the hedge to drift away from its target.

## Failure modes

* **Feed manipulation.** An attacker pushes a price away from its true value (typically through low-liquidity venues or short-window spikes) to trigger advantageous liquidations or arbitrage the protocol's pricing.
* **Feed staleness.** The oracle stops updating during a fast-moving market, so the protocol acts on a stale price while real conditions have moved.
* **Provider failure.** The oracle infrastructure itself fails or is paused, leaving the protocol without a current price.

## Mitigations

* **High-liquidity feeds** where available, raising the cost of single-venue manipulation.
* **Cross-checks between independent price sources** where multiple feeds exist, so a manipulated single source can be detected.
* **Staleness thresholds.** If a feed is older than its threshold, mint, redeem, and liquidation operations pause until a fresh price is available.
* **Pause behavior on parameter drift.** If a feed moves outside its expected envelope (rate of change, deviation from a reference), defined operations pause while the underlying state is examined.

See the [Oracles](/delpho-docs/how-delpho-works/oracles.md)page for the per-feed setup.

## Residual risk

No oracle architecture eliminates manipulation or staleness. The intent is to make manipulation expensive, detectable, and survivable rather than impossible.