On October 11, 2022, the MNGO-PERP feed on Mango Markets moved roughly tenfold inside twenty minutes. It was not wrong. Every constituent price behind that number — FTX, Serum, AscendEX, and Mango's own spot book — genuinely printed those levels. The oracle reported precisely what it was asked to report, at the cadence it was configured to report it.
By end of day an attacker had walked off with somewhere north of $110 million in borrowed assets, and the post-mortem vocabulary settled within hours: oracle manipulation. I still see that phrase used to close the file. It shouldn't be. The oracle was the messenger. What actually broke was the collateral model downstream of it — a system that let a thin, semi-self-referential spot market contribute a dominant share of a median, and then accepted that median as sufficient basis for nine-figure borrowing power with no liquidity-weighted haircut anywhere in the stack.
I have spent an unreasonable number of nights staring at feed freshness graphs during hours when nobody else is awake. The pattern that keeps surfacing is uncomfortable and it does not fit the standard narrative: the cascades I have traced do not come from feeds being late. They come from protocols that were configured as if feeds were instant.
That distinction matters far more in a range than in a trend. Compression kills volatility, kills funding, kills attention — and then a single $200 million wick clears four months of accumulated positions because nobody recalculated what a 0.5% deviation threshold means when the liquidation threshold sits at 0.825 and the asset moves 12% in an hour.
What a price actually is on-chain
Strip the branding and there are only two architectures, and both are about who pays for freshness.
Chainlink's classic Data Feeds run a push model. A decentralized oracle network aggregates node responses off-chain via OCR, then a single transaction posts the median on-chain. Two triggers cause an update: a deviation threshold — typically 0.5% on major pairs, wider on long-tail assets — or a heartbeat, historically 3600 seconds on Ethereum mainnet for many feeds. Between those triggers, the on-chain answer is stale by construction. That is not a bug; it's the gas economics of not writing to a $3,000-per-million-gas chain every block.
Pyth took the opposite bet. Publishers — exchanges, trading firms, market makers — sign a price plus a confidence interval roughly every 400 milliseconds. The aggregated update sits off-chain on Pythnet. Consumers pull it: you attach the signed update to your own transaction and pay to carry it. Freshness becomes whatever the caller is willing to fund.
For three years the industry treated this as a religious war. It wasn't. Watch what happened: Chainlink shipped low-latency, pull-based data streams aimed squarely at perpetuals and high-frequency lending markets. The architecture war ended in convergence, not victory. Push won the lending market's default slot; pull won the derivatives market's execution path. Anyone still arguing about which model is "correct" in 2026 is arguing about a question that was already settled by product roadmaps.
Three failures, one shape
Mango is the cleanest case because the oracle did nothing wrong. The attacker deposited MNGO, bought MNGO across venues to move the median, and borrowed against the inflated collateral. The feed honestly reported a manipulated market. The protocol's error was architectural, not informational: it priced collateral on a spot median while ignoring depth. A market where $5 million of buying moves the price 900% should never be able to collateralize $110 million in withdrawals. That is a liquidity-weighting failure wearing an oracle costume.
The USDC depeg in March 2023 is the inverse case, and far more instructive for anyone running risk today. When USDC printed below $0.90, feeds did fire — deviation thresholds exist for exactly that. The interesting damage came afterward, when lending markets paused or froze against a print that everyone believed was transient. That decision converted a price problem into a liquidity problem. Borrowers couldn't repay, LPs couldn't exit, and the bad debt didn't disappear — it got deferred into a queue that nobody had priced. Freezing a market doesn't prevent the loss. It just moves the loss to whoever is last in line.
Which brings me to the part almost nobody models, and the part I actually want to write down.
Suppose a protocol lists an asset at an 80% loan-to-value, 82.5% liquidation threshold — the standard Aave-shaped parameter block. Now suppose that asset's realized one-hour volatility is 6%. Apply a three-sigma stress: an 18% adverse move inside a single hour is not a tail event, it's a Tuesday. At an 82.5% liquidation threshold, an 18% drop means the position walks straight through the liquidation buffer into negative equity before any keeper's transaction can land. The liquidator gets paid. The protocol eats the shortfall. The parameter said this was safe.
The relationship is simple enough that it should be a lint rule in every risk repo: