Skip to main content

Price Oracles

To mitigate the risks of relying on a single oracle provider, Tenor built a new Morpho-compatible oracle smart contract, the Oracle With Validation, that validates the primary oracle price against a secondary feed.

Before any price-dependent action proceeds, the Oracle With Validation compares the primary oracle (e.g., Chainlink) against the validation feed (e.g., Chronicle or Redstone). If the two diverge beyond a configured deviation threshold, price calls revert and dependent operations (borrow, withdraw collateral, and liquidations) are blocked until the discrepancy resolves.

Not every market on Tenor uses the Oracle With Validation. Some markets are deployed against a single primary oracle without a cross-validation feed. Whether a given market uses the validated oracle, and which feeds back it, is visible in the market details on the app.

The deviation threshold is typically set below (1 - LLTV). This is wide enough that normal oracle drift does not trip the check, but tight enough to catch a large divergence. Normal drift comes from feed update cadence, decimal rounding, sequencer lag, or TWAP smoothing. By contrast, a large divergence usually means one feed has been manipulated or is stale. Once deployed, the primary and validation oracle addresses, the deviation threshold, and the validation-failure behavior are immutable.

The main risk of this design is that liquidations are also blocked while the validation check is tripped. If the validation feed misbehaves for a sustained period, healthy markets can be frozen along with the unhealthy ones, which is why the pause described below exists.

Pausing the Validation Check​

The Oracle With Validation can expose an owner-controlled pause on the validation step, documented under Pausable Functions. It can also be deployed without an active owner (for example, by renouncing ownership), in which case no pause is available. While paused, the contract returns the primary oracle's price without comparing it against the secondary feed. The primary oracle is always used to source the price; the pause only disables the validation check.

When available, the pause is intended for situations where the validation feed itself is blocking legitimate price calls, such as when a secondary source has been deprecated, is reporting stale data, or is diverging from market price for a sustained period. In that case, the owner can remove the validation check so that the market continues to function on the primary oracle alone.