How “Oracle-less Primitives” Are Rearchitecting DeFi

Intro

In his infamous thought piece “Why DeFi is Broken And How To Fix It”, Dan Elitzer articulated a compelling argument against the existing paradigm of DeFi protocols subject to heavy external dependencies.

Dan made the case that said dependencies have not only pulled us away from the fundamental principles that made DeFi novel and exciting in the first place, but additionally undermine DeFi’s ability to scale.

“Oracle-less primitives” are aiming to revive foundational tenets such as decentralization, trustlessness and composability ensuring that they are not optional luxuries, but prerequisites for a new DeFi paradigm.

With a handful of these revolutionary primitives currently live or soon coming to market, it seems pertinent timing to revisit the bull and bear case for an oracle-less future.

In this report, we will explore how external dependencies stifle DeFi’s ability to scale, lay out the bull case for an oracle-less future led by Ajna Finance, and entertain the inherent risks and tradeoffs assumed by an “oracle-less” design.

Is DeFi Broken?

An external dependency can be thought of as anything that has some dominion over a smart contract’s functionalities that is external to the contract itself. The most commonly cited dependencies are oracles and governance.

External dependencies introduce key weak points in protocol architecture. A significant share of price manipulation attacks and smart contract exploits are direct symptoms of said external dependencies. Consequently, while DeFi may not be fundamentally broken, external dependencies continue to restrain DeFi’s ability to cross the chasm.

Ultimately, external dependencies must obey the same natural laws governing all distributed systems. This means that developers are therefore faced with a tradeoff: either decentralize these dependencies and compromise on scalability or circumvent the scalability concerns but allow protocol integrity to boil down to said dependency as the new principal point-of-failure.

Unfortunately, given that the risks associated with the latter choice are generally easily obfuscated and beyond the scope of average user’s technical wherewithal, this has become the status quo for many lending and borrowing protocols.

Let’s explore these risks in more detail starting with one of the more hidden external dependencies quietly underpinning most protocols today.

Oracles

Presently, oracles secure around $45B in aggregate total value secured (TVS) which constitutes just under half of all DeFi TVL. Chainlink alone secures around $24B in value, primarily across lending and borrowing protocols such as Aave, Compound, and Spark.

Importantly, oracles have contributed to just over $1B in hacks since 2020 following the recent BonqDAO exploit in February. While oracle exploits constitute a large share of DeFi hacks to date, this number fails to reflect the more hidden role oracles have played in stifling DeFi’s ability to scale.

Moreover, unlike governance and upgradability, oracles provide smart contracts with the fundamental inputs from which a contract executes some output.

This means that if the sourcing and validation of this data does not follow an equally or more rigorous consensus mechanism than the underlying blockchain’s consensus mechanism, the entire protocol is reduced to the security and decentralization of the oracle. Hence, the infamous “oracle problem”.

 As visualized above, the oracle consensus mechanism quickly becomes the security bottleneck along the transaction supply chain. This is especially pertinent within the context of lending and borrowing and derivatives protocols whereby an oracle manipulation attack will cause unhealthy liquidations, placing the solvency of the protocol at risk.

Although there are some emerging oracle architectures aiming to more efficiently optimize the aforementioned tradeoffs. The net effect to date has been that either (1) oracle providers are only able to securely support a handful of short-tail assets or (2) protocols are forced to accept some “trust me bro” security assumptions that are passed on to end users. Compound was forced to delist a handful of longer-tail assets for this exact reason.

Governance

Given that protocols can’t underwrite asset listings without simultaneously underwriting risk, DAOs end up serving as the all-powerful gatekeepers of what assets can and cannot be listed.

The structural decision making around asset listings presents additional trust-assumptions. Each time a new asset is listed, numerous novel and hidden risk parameters are concurrently added. Taken to its logical conclusion, Aave and similar protocols end up scaling risk with the protocol itself.

DAOs are faced with a dilemma around who should ultimately monitor these risk parameters such as LTV ratios, interest rates, liquidations and maintaining the general solvency of the protocol.

While placing this burden on the shoulders of token holders would maintain a sufficiently decentralized governance structure, token holders are not well-equipped to make these decisions.

As a result, DAOs end up utilizing either delegates or some third party to handle this risk management (i.e. Gauntlet, Chaos, Warden, et