No Country for Old Prices: A Field Guide to DeFi Oracles
Primer on the use of oracles in onchain lending and an overview of the Steakhouse MetaOracle
Steakhouse MetaOracle
In decentralized finance, participants transact directly through public blockchains like Ethereum, removing counterparty risk at settlement. Yet other risks persist. To minimize them, DeFi participants work to reduce trust assumptions. Every transaction, such as an asset swap, requires agreement on price. Onchain, this price is supplied by an oracle that feeds data into smart contracts.
In money markets, both loan and collateral values depend on price accuracy. The challenge is to minimize trust while ensuring reliable pricing between assets.
Market participants have opposing incentives: Borrowers want to borrow as much liquidity as possible, pay interest rates as low as possible and avoid liquidation. Lenders, on the other hand, want to withdraw as much liquidity as possible, receive interest payments as high as possible and avoid losses.
Onchain lending markets, such as Morpho, incorporate technical mechanisms to balance these interests. Dynamic parameters such as the adaptive interest rate model can shift advantages between borrowers and lenders, freeing liquidity or stabilizing returns depending on market activity.
At the center of these dynamics lies the oracle price. It determines when liquidations occur and when bad debt forms. Setting it correctly requires care: how can we calculate an exchange rate between collateral and debt safely and credibly?
This post explores how we approach oracle design at Steakhouse Financial, including the release of MetaOracle, an open-source oracle adapter under the MIT license, built to help mitigate these trade-offs (Steakhouse MetaOracle, GitHub).
Oracle Dilemma
Designing an oracle is an exercise in trade-offs. Prices in lending markets often combine multiple oracle feeds. For example, the wstETH/USDC market on Base draws from three sources: wstETH/ETH, ETH/USD, and USDC/USD, weighted to produce a composite rate.
wstETH/USDC = WSTETH/ETH(0.5%) * ETH/USD(0.15%) * USDC/USD(0.3%)
There are three main types of feeds:
Market price
Market price is the observed trade execution price or one of its derivatives (Time-Weighted or Volume Weighted Average Price, or auction price). It reflects observed trading activity, whether from centralized exchanges, decentralized venues, or liquidity pools. Arbitrage usually aligns prices across venues, though discrepancies and manipulation risks remain. Market-based oracles can misrepresent the true trading price, complicating liquidations.
For wrapped assets, such as Paxos Gold, defining the correct market price requires deciding whether to track the underlying (spot gold) or the token’s onchain price. If we assume Paxos will always honor redemption at the primary market, spot gold is the appropriate feed. If we account for issuer risk, the price combines the spot gold feed with the Paxos Gold/gold rate. This rate represents the primary exchange rate of one token against real gold. It’s often called the fundamental ratio or collateralization ratio, and can be shared by the issuer’s administrative agent in Proof of Reserves.
NAV
The Net Asset Value represents intrinsic worth based on underlying holdings, not market trades. It is typical for staking derivatives (where the NAV is typically referenced as exchange rate) and tokenized funds, derived from onchain accounting or audits. The NAV reflects the claimable value per unit of the underlying collateral and is derived from onchain accounting (ERC4626 convertToAssets value), or third-party reports. NAV oracles resist short-term volatility but can trap liquidity if assets cannot be sold near NAV, creating risks of bad debt during stress events.
Hardcoded price
A fixed rate, such as 1 USDT = 1 USDC, assumes both tokens hold equal value. Over time, issuer-specific failures can break this parity, shifting losses to holders of the weaker asset.
The choice of feed defines how the market absorbs stress — and who ultimately bears the losses when conditions deteriorate.
Oracle setup economic risks
Each oracle type distributes risk differently. When prices deviate or liquidity dries up, the chosen feed determines whether losses fall on borrowers through liquidations or on lenders through bad debt and withdrawal constraints. The following section explores how each setup behaves across market conditions, from volatile pairs like BTC/USD to yield-bearing stablecoin pairs such as sUSDe/USDC.
Price Action
Short term volatility
Short-term volatility refers to a sharp price drop over a brief period. For volatile assets, the price does not always recover. For stablecoin pairs, such deviations usually correct quickly as arbitrageurs step in to buy discounted tokens and restore parity. Yield-bearing and non-yield-bearing stablecoins typically show little movement within a day, so the pre-drop price is considered the normal rate.
Short-term volatility often stems from thin order books or cascading liquidations that amplify one-sided trades. Since crypto markets operate continuously, these dislocations are usually resolved within hours. Persistent deviations may reflect structural issues, such as slow primary market redemptions or doubts about collateral quality.
During the drop: liquidation and bad debts
During a downturn, asset prices fall across venues - centralized exchanges, decentralized pools, and AMMs - where oracles continuously update prices. Borrowers monitor their health ratios, expecting potential liquidations when prices fall. Bad debt arises when seized collateral is worth less than the loan, often due to thin liquidity, network congestion, or sudden drops. Low-liquidity assets are most exposed, while heavily traded “blue-chip” assets are more resilient.
Stablecoin pairs can also drop sharply due to concentrated selling or reduced redemption liquidity. If the fall exceeds the loan’s safety margin (LLTV), liquidations may still fail, producing bad debt. Arbitrage eventually restores prices as traders redeem discounted tokens for underlying value, realigning the market with NAV. In both volatile assets and stablecoins, forced sales can trigger further price declines and additional liquidations.
Long-term troubles
For volatile assets, long-term risks mirror the short-term: extended price declines can sustain cycles of liquidation and bad debt. For stablecoin pairs, a lasting depeg signals a loss of confidence or issuer failure, akin to a default in traditional finance. In such cases, liquidators hesitate to act, and markets may require participants willing to absorb losses before liquidity returns.
Market Efficiency
An efficient market minimizes both liquidations (economic losses for borrowers) and bad debt (economic losses for lenders). While a persistent depeg makes losses inevitable, oracle design determines whether stress is absorbed or amplified.
In periods of short-term volatility, the simplest way to reduce bad debt is to avoid relying on the market price. Hardcoded or NAV-based feeds remain stable during sudden price swings, but they introduce their own risks.
Hardcoded or NAV feeds
During a crash
Collateral prices doesn’t adjust making it impossible to liquidate a position. Borrowers can exploit the stale valuation to borrow more, achieving higher effective LTVs than intended.
When the market normalizes
Since no liquidations took place, no bad debt is realized. Arbitrageurs and opportunistic borrowers may have drained available liquidity, creating a liquidity crunch when conditions revert.
Long-term risk
A liquidity trap may form if borrowers lock the protocol’s entire supply at artificially high LTVs, preventing depositors from withdrawing. A large depeg can create “shadow bad debt” that never clears because liquidation is permanently unprofitable, discouraging liquidators altogether.
Market feeds
During a crash
Market-based oracles reflect real-time price movements and trigger liquidations as soon as collateral values breach thresholds.
Bad debt is avoided if the liquidation process is efficient on three criteria:
Fast recognition of liquidatable positions: the onchain price must update close to the user’s LLTV breach. Oracle percentage thresholds or time-based buffers can delay recognition and postpone liquidations.
Profitable opportunities for liquidators: liquidation must be economically attractive, which depends on available liquidity in secondary markets and on operational readiness (high-priority transactions must still be executable during network congestion). In practice, liquidations are usually executed by MEV extractors competing to be first.
Timely execution before further price drops: once a position becomes liquidatable, it must be closed before the collateral’s market value falls below the outstanding debt and turns the position into bad debt.
When the market normalizes
When the market stabilizes, some users may have been liquidated and small amounts of bad debt may remain, but the system avoids large liquidity shocks since borrowers cannot overextend.
Long-term risk
The same mechanisms that ensure responsiveness also expose the market to volatility and liquidity constraints over time.
Different Layers of Market Price
Not all market oracles behave equally. For example, Paxos Gold (PAXG) tracked by a traditional XAU/USD feed remained stable above $4,000, while an onchain PAXG price feed fell to $3,739. This divergence shows that each oracle interprets “market price” differently. In practice, participants often prefer a stable hardcoded or NAV feed during short-term turbulence, and a market-based oracle once conditions stabilize.
A New Recipe: MetaOracle
In practice, the most resilient oracle design combines stability and responsiveness. MetaOracle achieves this by switching between two price sources: it ignores short-term volatility when price action is temporary, and switches to a fair market value when persistent deviations signal a real event.
MetaOracle (introductory post, GitHub) is an audited smart contract that automatically transitions between a primary oracle, designed to resist short-term swings, and a backup oracle, which reflects market prices when a deviation threshold is crossed. This setup merges the strengths of NAV or hardcoded feeds with those of market-based oracles.
Example: PT-sUSDe-27NOV/USDC
PT assets function like zero-coupon bonds traded on Pendle, representing the right to redeem at par on maturity. Their value depends on both Pendle market dynamics (demand for PT and YT tokens) and the underlying asset, Ethena sUSDe, itself tied to USDe.
The Primary Oracle uses a 15-minute TWAP Pendle PT-to-Asset price (a standard adopted by Morpho curators after analyzing the Pendle market parameters), with a hardcoded USDe/USDC rate of 1. This approach filters short-term volatility, assuming USDe maintains overcollateralization and parity through arbitrage.
The Backup Oracle combines the same Pendle TWAP with the Chainlink USDe/USD feed, introducing a market-sensitive adjustment when sustained deviations occur.
MetaOracle defaults to the primary feed. When the deviation between feeds exceeds the 0.75% deviationThreshold, anyone can call challenge(). After a 16-hour window (challengeTimelockDuration), if the discrepancy persists, acceptChallenge() activates the backup feed. A similar “healing” process restores the primary oracle once equilibrium returns. The mechanism is immutable, transparent, and open to all participants.
A Case Study: Ethena USDe on Friday October 10th, 2025
Since deployment, no MetaOracle contract has been challenged.
As a case study, let’s review the PT-sUSDe-27NOV2025 asset during the Friday 10th crash.
During this sharp market drop, USDe briefly traded down to 0.65 on centralized exchanges but remained near parity onchain. On Uniswap, it dipped to 0.972 USDT before quickly rebounding, while Chainlink’s oracle updated from 0.993 to 0.999 within minutes. The sUSDe NAV continued to rise, reflecting full collateralization, and PT prices stayed stable.
On Uniswap, USDe traded down from 1.0 to 0.972 USDT (22:59 UTC). The Chainlink USDe/USD oracle updated its onchain price to 0.993 (23:04 UTC) before a new update at 0.999 (23:05 UTC).
On the sUSDe side, the NAV of the asset continued to increase slightly, as no undercollateralization of Ethena USDe was observed (independent attestation). In the meantime, the traded price on Uniswap dropped from 1.199 to 1.195 due to market activity.
Meanwhile, the PT price remained relatively stable. With no depeg signal in its price feed, trading activity was limited.
No conditions were met to switch the MetaOracle price source: the deviation (USDe/USD Chainlink Oracle) was only 0.71% vs 0.75% required and the short term volatility didn’t persist long enough to pass the timelock.
No More Waste
A resilient lending market starts with rigorous due diligence on both issuer quality and asset quality. The oracle setup, LLTV calibration, and liquidation mechanics are the outcome of upstream selection and risk assessment before the asset is onboarded.
Within our risk framework, we assess whether the asset can safely support lending over time by examining its governance, transparency, primary markets, economic objectives, liquidity depth, and oracle responsiveness. Only once these foundations are verified do we define parameters that safeguard lenders while maintaining efficiency for borrowers.
Our role as curators is to preserve market integrity and resilience, not by reacting later, but by engineering the right conditions from the start:
Risk of bad debt is mitigated at the source, through asset selection and risk grading.
Efficiency is preserved over time, because parameters are built to withstand stress.
No amount of preparation can safeguard against every possible tail event in the market, but systems can be engineered for resilience to mitigate risks in advance. We hope that our MetaOracle can help curators create a safety net that performs when volatility strikes and remains sustainable over time.