Fringe Price Oracle Model

Protecting against oracle price attacks

Innovating DeFi Lending with Advanced Price Oracle Models

There is a problem in DeFi, and particularly with lending and trading platforms, whereby there is risk of price manipulation attacks (sometimes known as market manipulation attacks, price oracle attacks). We have a solution to mitigate that risk.

In an ecosystem where asset pricing is pivotal, the accuracy and security of price feeds are paramount.

Why are price manipulation attacks a problem?

Chainalysis estimates that DeFi protocols lost $399.1 million in 2021 and $403.2 million in 2022 to oracle manipulation attacks.

• see https://www.chainalysis.com/blog/oracle-manipulation-attacks-rising/

A critical aspect of decentralized finance is related to price oracles, and specifically how market manipulation poses risks to DeFi lending platforms. Market manipulation, a tactic where actors seek “highly profitable trading strategies” by artificially influencing asset prices, can have devastating effects.

Fringe Finance's Response to Price Manipulation

In response to these challenges, Fringe Finance has innovated with its enhanced price oracle model to mitigate these manipulation tactics.

• To note: Fringe's New Price Oracle Model is distinct to an actual oracle, in that it wraps around raw oracle price providers (such as Chainlink, PYTH and UniV3) to achieve protections against oracle price manipulation.

Key Features of the Enhanced Oracle Model

Resilience Against Manipulation: The cornerstone of Fringe's model is its robust defense against price manipulation. By applying advanced algorithms, we ensure that the prices reflect genuine market trends.

Improved Liquidation Processes: For borrowers, our model offers a smoother, more equitable liquidation curve, ensuring fairer prices during liquidations.

Enhanced Lender Security: Lenders benefit from a platform fortified against manipulation, ensuring reliability and greater safety of their assets.

Technical Insight: Price Update Mechanisms

Fringe’s price oracle model uses a blend of interaction-activated and bot-activated updates. Interaction-activated updates occur during user interactions, like deposits or loan repayments. Bot-activated updates are triggered when a price becomes outdated or a suspected attack is occurring, ensuring continuous accuracy and relevance.

Fringe’s new price oracle model applies a series of treatments to prices to help achieve this new resilience.

Understanding Price Sources

Diverse Price Sources: Fringe Finance integrates prices from multiple sources: Chainlink, Uniswap V3, and Pyth. Each asset on Fringe is linked to one of these sources, allowing Fringe to use the most relevant and reliable price source.

A model of safety

The raw price obtained from the underlying price source is then wrapped with Fringe’s New Price Oracle Model. The New Price Oracle Model applies various price treatments which provide resilience against market price manipulation attacks. The price treatments can be summarized as follows:

Treatment	Notes
Cap volatile price movements typical of price manipulation attacks.	To produce a Governed Price.
Employ a Long TWAP to limit an attacker’s profitability when undertaking price manipulation attacks.	Governed Prices are used as input to the Long TWAP accumulators to increase price manipulation resistance.
Long TWAP threshold parameters	The Long TWAP has a number of related threshold parameters used in its determination to minimise the effect of price manipulation attacks. Long TWAP threshold parameters avoid heavily weighting short-term, potentially manipulated, prices.
Employ a ‘minimum rule’ that selects the minimum of the Long TWAP price and the Governed Price.	To further increase price manipulation resistance. For collateral asset prices, a ‘minimum rule’ is applied. For capital asset prices, a ‘maximum rule’ is applied.
Price attack recovery mechanism - detects when a suspected price attack has ended.	And then logs the reverted prices to ensure the manipulated price is not heavily weighted in the Long TWAP calculation.

These are more fully described and illustrated below.

Volatility cap rules - Governed Price

• limit the impact of price manipulation attacks:

Long TWAP

• makes market price manipulation attacks less interesting for attackers:

• The above depicts the approach for collateral asset prices - which takes the minimum of Governed Price and Long TWAP Price.

  • to protect against upwards price manipulations.

• For capital asset prices, we take the maximum of Governed Price and Long TWAP Price.

  • to protect against downwards price manipulations.

Note the Long TWAP employs Governed Prices, thus further building on the protections of Governed Prices.

Long TWAP threshold parameters

• to limit the effect of price manipulation attacks:

The Long TWAP Threshold Parameters are designed to work hand-in-hand with the price cap treatment and Long TWAP to make price manipulation attacks less interesting for attackers.

These price processing techniques and parameterization combine to provide strong resilience against market price manipulation attacks.

Processing Steps

The following presents how each of the above techniques and thresholds are methodically applied to achieve the outcomes of more resilience against market manipulation price attacks.

The whole is greater than the sum of the parts.

Full, Partial and non-TWAP price processing paths

Fringe's oracle model processes prices through one of three paths: Full, Partial, and Non-TWAP, each tailored to specific asset characteristics and platform activity levels.

Treatment	Notes
Full Path	Employed for assets with higher platform interaction, this path encompasses all processing steps, ensuring the most comprehensive price data analysis.
Partial Path	When recent price-logging activity has already occurred in the ‘recent past’ (according to threshold parameters), the Partial path omits registering new long TWAP accumulator entries, thus balancing accuracy with operational efficiency.
Non-TWAP Path	For less frequently used assets, where extensive price processing isn't justified because of the high gas costs, we apply basic price governing without the Long TWAP (Time-Weighted Average Price) computations. This approach is cost-effective yet provides necessary market protection.

Price-logging bot

Fringe has established automated price-logging bots to ensure Long TWAP accumulators are logged sufficiently frequently to enable Long TWAP calculations to support the Full and Partial price processing paths.

Also, the price-logging bot detects when a suspected oracle price attack has ended (via threshold price movements) and then promptly logs a new Long TWAP accumulator entry. The purpose of this is to minimize the weighting of any accumulator that was logged during the suspected price attack and therefore minimize the effects of the attack on pricing used by Fringe.

Rationale and Benefits

The table below presents the rationale for the various aspects of Fringe's new price oracle model and the benefits they deliver.

Device	Description	Purpose
Min	Minimum of the two prices	Aims to ignore any short-term upwards price manipulation events. Minimises risk of upwards price manipulation events because it increases the time window an attacker needs to manipulate a price. This increases the attacker’s cost of the attack and hence decreases the profitability and likelihood of an attack.
Max	Maximum of the two prices	Aims to ignore any short-term downward price manipulation events. Minimises risk of downwards price manipulation events because it increases the time window an attacker needs to manipulate a price. This increases the attacker’s cost of the attack and hence decreases the profitability and likelihood of an attack.
TWAP & min/max function	Extend time for an attack	This refers to the TWAP produced by our new price oracle. Purpose of long TWAP (when combined with a volatility cap on samples and min/max treatment) is to cause price manipulation attacks to need to occur over a longer period of time before they impact price.
Volatility Cap	Limits the rate at which the price can change per time period.	Borrower protection Aims to ignore sharp short-term downward price movements that may be due to market attacks, where attackers attempt to force liquidations to gain access to collateral at a deflated price. Lender protection Also, works to force upwards price manipulation attacks to occur over a longer period of time, which makes such attacks more expensive (and hence less likely to impact Fringe.)
minSampleInterval	Avoid overly-frequent logging	Mitigates risk of excessive gas costs from unnecessarily-frequent sample logging.
logMaturingAge	Avoid all price series entries being too recent	Ensuring all price series entries are not too recent strengthens protection against market price manipulation attacks. If the long TWAP is based only on very recent price points, it will not be (sufficiently) differentiated from the reportedPrice to offer protection when reportedPrice reflects a market price manipulation. The other reason why we care about samples older than logMaturingAge existing is so that a manipulated price is sufficiently amenable to error correction. This means that so long as there are older prices, they limit undue weighting of the attack price points. Our bot can detect the (suspected) attack has passed and begin to log new corrected prices. The resultant longTWAPprice will not be unduly weighted by the attack price points.

Caption - Table of rationales and benefits

Expanding Asset Inclusion

The new oracle model is not just about protection – it's about including support for even long-tail assets. By allowing diverse price sources and minimizing attack risks, we're integrating a wider range of assets, previously unavailable in the DeFi lending market. We believe this will be attractive for retail long-tail asset holders, DAOs who hold part of their treasury in their project token and speculators wishing to either go long or short for a wide range of assets.

Future Developments: Incentivized Bots and Decentralization

Looking ahead, Fringe plans to further decentralize the platform. One initiative is incentivizing third-party bots for price updates, enhancing the platform's resistance to censorship and centralized failures.

Conclusion: A Leap Forward in DeFi Lending

In summary, Fringe Finance's new price oracle model marks a significant advancement in asset pricing within DeFi. By offering improved protection against market manipulations and supporting a broader range of assets, we are not just enhancing our platform but also contributing to the evolution of the DeFi sector as a whole. In the endeavor to increase DeFi’s anti-fragility, Fringe is innovating to set a new standard for resilience against market manipulation attacks.