Oracle Manipulation Risk Report: Deribit

本文为原文前 6,000 字符的节选翻译，完整内容请查看原文。

Oracle Manipulation Risk Report: Deribit

Oracle Manipulation Risk Report – Deribit Target Protocol: Deribit (TVL: $3864.5M) Protocol: Deribit (Derivatives exchange, primarily on Ethereum L1 & L2 roll‑ups) TVL (as of 13 Oct 2026): $3.86 B (Ethereum + L2) Prepared by: Senior DeFi Security Researcher – Smart‑Contract Auditing Team Date: 13 Oct 2026

预言机操纵风险报告：Deribit 目标协议： Deribit (总锁仓量：38.645 亿美元) 协议： Deribit（衍生品交易所，主要基于以太坊 L1 和 L2 Roll-up） 总锁仓量（截至 2026 年 10 月 13 日）： 38.6 亿美元（以太坊 + L2） 编制： 高级 DeFi 安全研究员 – 智能合约审计团队 日期： 2026 年 10 月 13 日

1. Executive Summary

Deribit is a leading crypto‑derivatives platform offering perpetual swaps, futures, and options on major spot assets (BTC, ETH, SOL, etc.). The protocol’s core risk surface is its reliance on price oracles to settle contracts, trigger liquidations, and calculate funding rates. Our assessment focuses exclusively on oracle‑related attack vectors that could lead to: Incorrect settlement, unfair liquidations, funding‑rate abuse, and systemic loss of confidence.

1. 执行摘要

Deribit 是一家领先的加密衍生品平台，提供针对主流现货资产（如 BTC、ETH、SOL 等）的永续合约、期货和期权交易。该协议的核心风险面在于其依赖价格预言机来结算合约、触发清算以及计算资金费率。我们的评估专门针对可能导致以下后果的预言机相关攻击向量：结算错误、不公平清算、资金费率滥用以及可能引发连锁保证金追缴和 TVL 快速流失的系统性信心丧失。

Key Findings

Single-source price feed: High severity, 8/10 rating.
Insufficient TWAP window (≤ 30 s) on L2: High severity, 9/10 rating.
Lack of fallback / emergency oracle: Medium severity, 6/10 rating.
Cross-chain price aggregation without finality guarantees: Medium severity, 7/10 rating.
Governance-controlled oracle parameters: Low-Medium severity, 5/10 rating.

关键发现

单源价格馈送： 高严重性，评分 8/10。
L2 上不足的 TWAP 时间窗口（≤ 30 秒）： 高严重性，评分 9/10。
缺乏备用/紧急预言机： 中等严重性，评分 6/10。
缺乏最终性保证的跨链价格聚合： 中等严重性，评分 7/10。
治理控制的预言机参数： 低至中等严重性，评分 5/10。

2. Identified Attack Vectors

2.1. Single‑Source / Centralized Feed Dependency: Deribit primarily uses its internal order‑book and one external exchange feed. If the external feed is compromised or the internal order‑book is thin, an attacker can push the price with modest capital.

2. 已识别的攻击向量

2.1. 单源/中心化馈送依赖： Deribit 主要使用其内部订单簿和一个外部交易所的馈送作为基准价格。如果外部馈送被篡改或内部订单簿深度不足，攻击者可以用相对较少的资金推动价格。

2.2. Short TWAP Window & Low Update Frequency: A 30‑second TWAP is calculated on‑chain. An attacker can use a flash‑loan to spike the price within a single block, causing forced liquidations of honest users while the TWAP fails to smooth the outlier.

2.2. 短 TWAP 时间窗口与低更新频率： 链上计算的是 30 秒的 TWAP。攻击者可以利用闪电贷在单个区块内拉高价格，导致诚实用户的仓位被强制清算，而 TWAP 无法平滑该异常值。

2.3. L2‑to‑L1 Price Relay Without Finality Guarantees: Prices computed on L2 are posted to L1 via a bridge that finalizes after ~5 L1 blocks. An adversary can front‑run the finalization by submitting a manipulated price on L2 and withdrawing on L1 before the bridge updates.

2.3. 缺乏最终性保证的 L2 到 L1 价格中继： 在 L2 上计算的价格通过一个在约 5 个 L1 区块后确认的桥接器发布到 L1。攻击者可以通过在 L2 上提交操纵价格来抢先完成最终确认，并在桥接器更新前在 L1 上进行提现。

2.4. Absence of a Robust Fallback Oracle: If the primary feed fails, Deribit pauses settlement. An attacker can induce a DoS on the primary feed to freeze the market, then exploit the panic to open large leveraged positions on external venues.

2.4. 缺乏稳健的备用预言机： 如果主馈送失效，Deribit 会暂停结算。攻击者可以通过对主馈送发起拒绝服务攻击（DoS）来冻结市场，然后利用恐慌情绪在外部平台开设大额杠杆头寸。

2.5. Governance‑Controlled Oracle Parameters: If a malicious entity gains majority voting power, they could downgrade the TWAP window or add a compromised source, creating a long‑term backdoor.

2.5. 治理控制的预言机参数： 如果恶意实体获得多数投票权，他们可以缩短 TWAP 时间窗口或添加受损的数据源，从而制造长期的后门。

2.6. Cross‑Asset Correlation Exploits: By manipulating two correlated assets simultaneously via flash‑loans, an attacker can create a funding‑rate arbitrage loop to extract value.

2.6. 跨资产相关性利用： 通过闪电贷同时操纵两种相关资产，攻击者可以制造资金费率套利循环，从而从协议中提取价值。

3. Prioritized Technical Recommendations

Critical: Integrate at least 3 independent, high‑liquidity feeds (e.g., Chainlink, Band, Pyth) and compute a median price on‑chain.
Critical: Extend TWAP Window to ≥ 5 minutes with exponential decay weighting.
High: Implement an L2‑to‑L1 Finality Guard requiring two consecutive L2 state roots before accepting prices.

3. 优先技术建议

关键： 集成至少 3 个独立的、高流动性的数据源（如 Chainlink、Band、Pyth），并在链上计算中位数价格。
关键： 将 TWAP 时间窗口延长至 ≥ 5 分钟，并采用指数衰减加权。
高：实施 L2 到 L1 的最终性保护机制，要求在接受价格前必须有两个连续的 L2 状态根。