DeFi

Chainlink Oracle

A Chainlink oracle integration reads price or rate data from Chainlink Data Feeds, usually through AggregatorV3Interface.

A Chainlink oracle gives a contract an external price or exchange rate, but the integration still needs safety checks.

Chainlink Oracle Explained in Detail

Chainlink Data Feeds expose price or rate data through feed contracts. Solidity integrations commonly call latestRoundData() and decimals().

Using a reputable feed does not remove integration risk. The contract still needs to validate freshness, positive answer values, decimals, feed address, and network assumptions.

Smart contract example

(, int256 answer,, uint256 updatedAt,) = feed.latestRoundData();
require(answer > 0, "bad price");
require(block.timestamp - updatedAt <= maxStaleness, "stale price");

This checks that the answer is positive and recent.

Chainlink Oracle in Auditing

Oracle values often control borrowing, liquidations, minting, redemptions, and limits. A small integration bug can become a protocol-wide solvency issue.

Auditors check the feed itself and every scaling step after the read.

Red flags in code

  • Uses deprecated latestAnswer() without timestamp checks.

  • Accepts zero or negative answers.

  • Ignores feed decimals().

  • Uses the wrong feed address, pair, network, or feed type.

  • Omits L2 sequencer checks where needed.

How to test or review it

  • Mock stale, zero, negative, reverted, and extreme answers.

  • Verify feed address and intended market or exchange-rate feed.

  • Check updatedAt, answer, and decimal normalization.

  • Test market-hours and L2 sequencer assumptions when relevant.

  • Add circuit breakers or bounds for sensitive actions.

Sources