Oracle staleness check present
A oracle & external dependencies factor in the v1.7.0 rubric. Measured per protocol on a s cadence.
Methodology how we score #
**What this measures** This factor checks whether the protocol implements an oracle staleness check — specifically whether it validates that the oracle's `updatedAt` timestamp is more recent than `now - maxAge` before accepting the reported price. Source inspection of the oracle integration layer is the assessment method.
**Why it matters** Without a staleness check, a protocol will continue to use a price that was last updated hours or days ago as if it were current — a failure mode that becomes critical during network congestion, oracle outages, or periods of extreme market volatility when keepers fail to update feeds. Chainlink feeds have experienced significant delays during high gas-price events; a protocol operating on a stale price during a rapid market move can process borrows against collateral that is actually worth far less than the stale price indicates, creating bad debt. This is a particularly common implementation gap in DeFi: many protocols call `latestRoundData()` but never check the returned `updatedAt` timestamp, leaving them silently operating on stale data.
**Green / Yellow / Red** Green is scored when the protocol checks `updatedAt > block.timestamp - maxAge` for all oracle reads, and the maxAge is documented and appropriate for the asset class. Yellow is scored when a staleness check exists but maxAge is excessively long (over 24 hours for non-stablecoin assets) or is not documented. Red is scored when no staleness check is present and the protocol accepts any price regardless of when it was last updated.
**Common gray cases** Gray is applied when the oracle uses a push-based feed where timestamp validation is handled by the feed contract rather than the consuming protocol and the mechanism cannot be confirmed from inspection alone.
**Notable historical examples** No cross-hacked incidents are currently linked in the database for this factor.
Measurement what to look for #
Determine whether the protocol rejects oracle reads older than a declared maximum age (i.e., checks `updatedAt > block.timestamp - maxStaleness`).