News for hackers. Stuff that matters.
Re:The collapse of the IRON stable coin by chrisco255 on Thursday June 17, 2021 @08:54PM (#27546173)
An oracle is a source of truth for information about the outside world to a smart contract. The smart contract doesn't actually call the oracle. This is because smart contracts don't self-execute and can't make external http calls. So a smart contract pauses, and waits for an oracle to trigger an update function. Because oracles have a lot of power over a smart contract (not all smart contracts need them, by the way), they have to be done in a secure way. The market leader in decentralized oracles is Chainlink. They power hundreds of DeFi applications.
Re:The collapse of the IRON stable coin by nieve on Thursday June 17, 2021 @09:23PM (#27546404)
At that point can they really be considered purely code contracts anymore? If their execution requires a trusted third party some of the rhetoric goes out the window.
Re:The collapse of the IRON stable coin by chrisco255 on Friday June 18, 2021 @02:35AM (#27547913)
They're sort of hybrid networks at that point, but Chainlink oracles are decentralized: each function is run by several nodes (31 for the BTC/USD or ETH/USD price feed, for example). The nodes have to come to consensus and individual nodes are slashed if they produce bad or late data. You can see an example of a LINK feed here: https://data.chain.link/ethereum/mainnet/crypto-usd/eth-usd

Decentralization is a spectrum. But I would argue this approach is far more secure than naive oracle implementations.

Not all applications need oracles. It depends on whether your smart contract needs information about the world outside of the blockchain.

Re:The collapse of the IRON stable coin by ric2b on Monday June 21, 2021 @05:40PM (#27584886)
Who owns those 31 nodes? Who gets to choose which nodes are part of the calculation?
Re:The collapse of the IRON stable coin by lifeformed on Thursday June 17, 2021 @11:50PM (#27547181)
I think they're just other smart contacts that use many data sources. Like if you wanted an oracle that returned the result of a baseball game, you'd have it check various newspaper websites and have it make sure the results were all the same. To attack it, you'd have to attack all the newspaper sources. It's still a weak point, but not quite a single point of failure.