Sign in Subscribe

What Happens When Oracles Think Twice: Permissionless Oracle Design

What Happens When Oracles Think Twice: Permissionless Oracle Design

DeFi lending relies on one invisible but essential component: oracles.
These are systems that tell protocols what assets are worth. When they fail, the consequences are immediate: hacked pools, bad debt, and capital flight. But when these oracles are designed well, you deliver superior UX and reduce the risk significantly for both borrowers and lenders.

The key behind turning oracles from an attack vector to a mechanism of delivering superior UX relies on finding out the real value of an asset from the prices these feeds report.

This article explains how an innovative dual-oracle design helps Gearbox lower liquidation risk for borrowers without risking bad-debt for lenders.

The Two Ways to Price Value in DeFi

Price can sound like a simple term but, in practice, determining the right price isn't as straightforward. Should an LRT trading 0.99ETH on DEXes be valued at 0.99ETH if its peg at the reserves holds a value of 1 ETH? Answering questions like these is crucial for a lending protocol to assign value to collateral. There are only two ways to do it:

  1. Fundamental Price: based on the intrinsic value of an asset’s backing.
    For example, vaults or LRTs (Liquid Restaking Tokens) often mint new shares at their net asset value (NAV).
  2. Market Price: based on what participants are actually paying on exchanges, DEXes.

Gearbox's approach aims to utilise both in order to find the right value of an asset and how the value should be determined across market scenarios.

The Dual-Oracle System

If a market relies solely on fundamental oracles, valuations stay stable but can drift far from market reality. If they rely on market oracles, instant valuations stay real but can fluctuate wildly, even to the point of triggering bad debt.

Gearbox’s Dual-Oracle System solves this by using both types of oracles simultaneously for every collateral asset. Each asset in Gearbox is linked to two separate price feeds:

  • Main Feed: the price used for routine operations, such as determining when to liquidate a position.
  • Reserve Feed: a secondary “check” that acts as a guardrail against incorrect or outdated valuations.

Liquidating too early erodes borrowing experience while liquidating too late leads to bad debt. To determine an asset’s Safe Price, the protocol takes the lower value between the two feeds:

Safe Price = min(Main Feed, Reserve Feed)

This rule ensures the system always errs on the side of caution. If one feed shows an unrealistically high price (for example, due to manipulation or a stale update), the lower feed prevents the protocol from lending more than it should.

But in case if one feed reports a low price while the other doesn't, Gearbox's Dual-Oracle system is built to identify the real value and approach the situation accordingly, without risking unnecessary liquidations. How?

How the Dual-Oracle System Works

The Dual-Oracle framework dynamically adapts depending on the type of participant and the market environment. It can operate in two broad configurations:

1. Borrowing Mode: For truly onchain assets

In borrowing mode, the Main Feed is set to the fundamental price, while the Reserve Feed is the market price.

This configuration is ideal when market prices are volatile, but the goal is to provide borrowers predictable collateral valuations. Assets utilising this should ideally have provable reserves, redemptions and a track record of being arbitraged back to peg. This mode provides:

  • Safe leverage: Because fundamental prices remain stable unless the underlying is hacked/slashed, borrowers are not unfairly liquidated by short-term volatility or temporary liquidity issues on exchanges.
  • Exploit prevention: If the market price of collateral drops below the fundamental price (for example, if a vault share trades at a discount), the “min” rule ensures the protocol still uses the lower value. This blocks the classic “buy cheap, borrow expensive” exploit that has affected other lending platforms.

In other words, borrowing mode allows users to take leverage with confidence while maintaining strict protection against manipulated or inflated valuations and keeping lenders safe.

No liquidation has occured for an asset using fundamental oracles as the main feed on Gearbox till date.

2. Lending Mode: Safety Priority

For assets that don't have provable withdrawals, reserves or a history of maintaining a strong peg, the Main Feed becomes the market price and the Reserve Feed becomes the fundamental price.

This configuration prioritizes the safety of liquidity providers. It ensures that liquidations occur quickly when the market value of collateral genuinely falls, preventing bad debt from forming.

  • Rapid liquidation response: Because the Main Feed tracks real-time exchange prices, the system can react immediately to price declines.
  • Protection against fake rallies: If a sudden upward spike in market price is caused by thin liquidity or wash trading, the Reserve (fundamental) feed serves as a brake. The “min” rule ensures the protocol does not overvalue the collateral.

In effect, lending mode prioritizes capital preservation for LPs while still acknowledging genuine market movements.

This mechanism has not been built on theory but on the back of Gearbox operating lending markets for 3+ years. The best way to understand this mechanism is through the lens of the market.

Dual-Oracles Through the Lens of the Market

To understand how the Dual-Oracle mechanism keeps lending markets stable, let’s look at three real-world scenarios:

Scenario 1: Normal Market Conditions

Context:
An LRT (Liquid Restaking Token) has a fundamental value of $100, and the market price is trading around $99–$101.

How Other Protocols Handle It:

  • A fundamental-only oracle will always show $100, ignoring market drift.
  • A market-only oracle will follow every tick in price, even if the changes are momentary.

How Gearbox Handles It:

  • Main Feed (Fundamental): $100
  • Reserve Feed (Market): $99
  • Safe Price: min($100, $99) = $99

The primary feed being a fundamental one stops users from getting liquidated as the intrinsic value is known. On other protocols, this would result in borrowers being able to borrow more than risk parameters would allow as the collateral will be overvalued.

But Gearbox takes the lower of the two values and thus isn't aware just about the real value but also the real price, making sure risk parameters function as designed. This keeps operations conservative but flexible, borrowers aren’t liquidated due to tiny market moves, and lenders remain protected from overvaluation.

Key takeaway: Under stable conditions, the Dual-Oracle behaves just like a cautious, market-aware valuation model.

Scenario 2: Manipulated or Illiquid Market

Context:

A malicious actor manipulates an LRT’s market price on a low-liquidity DEX, instantly pushing it from $100 down to $50.

What Typically Happens elsewhere:

  • In a market-only system, the oracle instantly reports $50.
  • This triggers mass liquidations, borrowers’ positions are closed even though the asset’s true backing is still $100.
  • Lenders and borrowers both suffer unnecessary losses.
  • In a fundamental-system, the attacker can now borrow more from the lenders for every LRT and put them at risk.

What Happens with Gearbox:

  • Main Feed (Market): $50
  • Reserve Feed (Fundamental): $100
  • Safe Price: min($50, $100) = $50

Now here’s the key part: if liquidations at this market price would lead to bad-debt, the protocol checks again using the fundamental price:

  • If the borrower would still be solvent at the fundamental price, liquidation is prevented.

This prevents exploiters from using malicious price dips to drain liquidity or trigger cascading liquidations. The lower value still prevents borrowers from borrowing at overvalued prices.

However, if the liquidation doesn’t cause bad-debt, a secondary check of fundamental prices won’t be triggered and the liquidation would still occur. The goal of the mechanism is to identify possible attack vectors and not to hamper the intended operation of the market oracle used by the curator.

Key takeaway: The Dual-Oracle +  Loss Policy combination acts as a second line of defense against oracle manipulation and flash-crash exploits.

Scenario 3: Underlying Asset Faces a Hack or Slash

Context:
The protocol issuing the asset reports a loss through either hacks or crash. Collateral tokens are trading down rapidly, and liquidations are piling up across protocols.

In Traditional Systems:

  • Fundamental oracle drops in value instantly, using this leads to the most timely liquidation
  • Market prices reacts to this change instead of proactively detecting
  • Liquidations accelerate, often selling collateral far below its true worth.
  • Protocols incur bad debt because assets are sold at distressed prices.

In Gearbox:

  • Main Feed (Market): $60
  • Reserve Feed (Fundamental): $85 (remaining assets, new peg)
  • Safe Price: min($60, $85) = $60

Normally, the system would liquidate based on the market feed. But as the price of the asset falls even at the fundamental level, the SafeMin updates and checks whether liquidation at this price would generate bad debt.

If, under the fundamental price ($85), the position approaches liquidation:

  • The liquidation goes through at the required point.
  • Funds are returned to lenders and they remain safe.

If, under the new fundamental price ($85), the position would still be healthy:

  • The liquidation does not go through.
  • The system waits until prices stabilize before re-evaluating.

This mechanism prevents unnecessary fire sales and keeps the lending pool solvent even in extreme volatility.

Key takeaway: Gearbox’s oracle framework doesn’t just follow markets but interprets them intelligently.

Why This Design Matters

The Dual-Oracle System represents a shift from reactive risk management to intelligent risk curation.

In traditional DeFi lending, oracle design is often a binary choice:

  • Pick stability and risk being outdated, or
  • Pick reactivity and risk being manipulated.

Gearbox bridges this divide through:

  1. Dual Data Sources: Combining fundamental and market values to create a self-correcting pricing model.
  2. Dynamic Conservatism: Always using the lower value between two feeds ensures the system is never overexposed to optimism or manipulation.
  3. Intelligent Liquidation Logic: The Aliased Loss Policy ensures that liquidations happen for insolvency, not for temporary volatility.

The result is a system that stays solvent in the worst of times and competitive in the best of times, a foundational requirement for scalable, permissionless credit markets.

The Outcome: Resilient Lending, Permissionless Risk

In recent months, seven independent curators have launched on Gearbox across five chains, extending this model of permissionless risk curation across ecosystems.

DeFi lending no longer needs to rely on a single version of “truth.” By allowing fundamental and market data to coexist, Gearbox built a system that’s adaptive, transparent, and engineered for the volatility of real markets.

In the world of on-chain credit, the right oracle architecture isn’t just a data feed but the difference between solvency and collapse.

If you are an institution or curator looking to expand your operations onchain, Gearbox can offer you the credit infrastructure you require. Contact us on Telegram or Discord, and get in touch. Let’s build the onchain economy together!

Notion – The all-in-one workspace for your notes, tasks, wikis, and databases.
A new tool that blends your everyday work apps into one. It’s the all-in-one workspace for you and your team
Notion
JOIN NOW