Last updated: July 02, 2025
SCWE-086: Missing Validation of Oracle Response Fields (Stale or Incomplete Data)
Stable Version v0.0.1
This content is in the version-(v0.0.1) and still under active development, so it is subject to change any time (e.g. structure, IDs, content, URLs, etc.).
Send Feedback
Relationships
Description
This weakness occurs when smart contracts consume data from oracles (e.g., Chainlink) without validating critical fields in the response such as answeredInRound
, timestamp
, or even the answer
itself. Failing to validate these fields can lead to:
- Use of stale price data from old oracle rounds.
- Acceptance of incomplete oracle responses (e.g.,
timestamp == 0
).
- Execution based on invalid or zero-priced data.
This can severely affect the security of DeFi protocols or any smart contract relying on accurate, fresh data feeds.
- Validate
answer
field: Ensure the value returned is greater than zero and not malformed.
- Check
answeredInRound >= roundId
: Confirms that the data is not from a stale round.
- Verify
timestamp != 0
: Ensures that the oracle actually returned a complete result.
Additional best practices include:
- Using fallback mechanisms or thresholds for deviation checks.
- Halting sensitive functions if oracle data is suspect or missing.
Examples
References