https://youtu.be/1CHnMeuFd7g?embedable=true In the presentation above, Connor Martin, Ex-head of Protocol Partnerships at Uniswap, examines the inner workings and potential vulnerabilities of the Uniswap TWAP oracle and oracle library – which Connor contributed to during his time at the DEX. Before we dive into his presentation, below are some key terms to know. What is Uniswap? Uniswap is a decentralized exchange (DEX) that allows for peer-to-peer exchanges of without the need for a centralized third party. It is a censorship-resistant and immutable protocol, meaning it cannot be upgraded or changed with human intervention. Unlike centralized exchanges (CEX) that use centralized order books, the design of DEXs make use of publicly funded for exchange. The exchange rates in AMM liquidity pools can be used as on-chain price oracles. There are several ways to derive the price of an asset from AMM liquidity pools, one of them being the calculation of the time-weighted average price – TWAP. ERC20 tokens Automated Market Maker (AMM) liquidity pools Uniswap V3 All liquidity pools on Uniswap V3 are able to act as oracles by storing and providing access to liquidity and historical price data. Time-Weighted Average Price, or TWAP, is an aggregation method that calculates the mean price of cryptocurrencies over a specified period of time. Using TWAP to derive the price, instead of simpler aggregation methods, helps to weed out short-term price changes and is also much harder to manipulate. While Uniswap V2 introduced TWAP oracles, the most recent upgrade, V3, introduces some major improvements to this price oracle design. by Uniswap provides more details about the V3 upgrade. This article On Uniswap V3, prices are expressed and stored using “ticks”. These ticks are distributed in a way that an increase or decrease of 1 tick would equal 1 “bps” at any point. Bps (pronounced as Bip) or Basis Points, are a unit of measure in finance traditionally used to express the changes in interest rates of financial instruments. One basis point equals to 0.01%. How prices, or current tick data is stored, is crucial for effectively querying oracles on Uniswap V3. For a more detailed explanation on ticks and other features of the Uniswap V3 oracle, refer to the documentation and this that explains the concepts in further detail. here medium post Manipulating Uniswap V3 Intra-block Manipulation The first issue with Uniswap V3 that is highlighted by Connor is the likelihood of intra-block manipulation. Intrablock manipulation is a type of attack that happens within the same block in a blockchain. One of the most popular forms of intra-block manipulation are flash loan attacks. Flash loans allow users to borrow as much as they want with no capital on lending protocols. A flash loan attack occurs when a bad actor takes out a flash loan, manipulates the price of an asset by a large percentage on one exchange, and exploits the inaccurate price by selling, buying, or borrowing against the asset at false prices on another protocol, all within one block. One example of a flash loan attack would be the exploit of $130 million that took place on in 2021. Cream Finance Block-spanning Manipulation While the Uniswap V3 oracle utilizing Time-Weighted Average Prices (TWAP) is good for preventing intra-block manipulation, it is less effective at preventing “block-spanning manipulation”, which is a type of manipulation that occurs over several blocks in the blockchain. Connor cites the example of the Rari Capital exploitation as an example of a block-spanning attack. Check out by our media partner, Rekt News for full details of the exploit. this article This by one of BOS22’s platinum sponsors, , is a great source for more information on the vulnerabilities of TWAP oracles. In this article, Euler’s CEO provides an in-depth analysis of the true cost of manipulating Uniswap’s V3 TWAP oracle. research article Euler XYZ Michael Bentley The Oracle Library The Uniswap oracle library was  created to help protocols consume prices in ways that were more resistant to manipulation. The oracle library is a suite of functions developed by Connor and the team at Uniswap to help developers easily and safely integrate applications with the V3 oracle. In his presentation, Connor explains how to use the oracle library in full detail. also provides more information on the functions of the oracle library. This documentation Connor ends his presentation by emphasizing the need for more standardization of oracle data as well as a call to developers to use the open-source oracle library to experiment with price aggregation and logic breaks. He mentions the OracleSlippage.sol contract as an example which can be found . More details about the security, capabilities and architecture of the Uniswap V3 TWAP oracle can be found in by Chaos Labs. here this article The Blockchain Oracle Summit was the world’s first conference to focus solely on oracles’ importance and design. Leading speakers from across the DeFi-Tradfi spectrum came to Berlin to take deep-dives into the biggest challenges faced in terms of building and using oracles. Find out more about Uniswap Labs: Uniswap Documentation Uniswap Twitter Uniswap Discord Uniswap Website Connor Martin Twitter

This story contains new, firsthand information uncovered by the writer.

How to Evaluate Security of Different Oracle Designs

0VIX Launches Pre-mine, Introducing Unique Risk Management Feature 

As the transmitters of truth on a blockchain, oracles are one of the most crucial aspects of technology’s next chapter. The goal of the Blockchain Oracle Summit is to bring builders, users and investors together, to accelerate growth in the oracle space. While scaling oracles to meet growing demand, careful attention needs to be paid to maintaining costs, decentralization, trust and more. Immutable blockchains need to be complemented by the most robust oracle networks. 

Too Long; Didn't Read

Make resilience your competitive advantage

Finding the Best Method to Aggregate Data Feeds

About Author

Comments

TOPICS

THIS ARTICLE WAS FEATURED IN

Related Stories

Untitled Story

0VIX Launches Pre-mine, Introducing Unique Risk Management Feature

AMM: Your Secret Weapon For DeFi Liquidity

Attacks and Bounce Backs Make the Crypto Ecosystem Smarter and Stronger: Unhashed #29

Automated Market Makers (AMM): Priming a Financial Revolution using Smart Contracts

Automated Market Making With Equal and Self-Adjusting Governance Token Distribution

0VIX Launches Pre-mine, Introducing Unique Risk Management Feature

AMM: Your Secret Weapon For DeFi Liquidity

Attacks and Bounce Backs Make the Crypto Ecosystem Smarter and Stronger: Unhashed #29

Automated Market Makers (AMM): Priming a Financial Revolution using Smart Contracts

Automated Market Making With Equal and Self-Adjusting Governance Token Distribution

Light-Mode

Classic

Newspaper

Dark-Mode

Neon Noir

Minty

HN StartUps