Ten gates before trusting an EVM LP oracle

An oracle factory address is not a valuation guarantee. Before an integration treats an LP oracle as collateral truth, verify all ten gates against one immutable deployment and one concrete consumer.

1. Pin the deployed build. Record the factory, implementation or instance runtime hash, compiler settings, immutable values, creation transaction, source commit, and proxy status. “Current main” is not deployment identity.

2. Prove a reachable consumer. Enumerate oracle instances created by the factory and identify the exact lending, margin, accounting, or withdrawal path that consumes each price. A hypothetical discrepancy without a reachable asset-moving consumer is not demonstrated impact.

3. Bind token order to feed order. Generic feed interfaces do not prove what asset a feed prices. Compare pool registration order, oracle feed order, and consumer denomination explicitly.

4. Name the denomination. For wrappers and rate-bearing assets, state whether each feed prices a share or its underlying. Then show exactly where token decimals and rate-provider conversion are applied. Apply each conversion once—not zero times and not twice.

5. Separate feed freshness from rate freshness. The oldest Chainlink-style feed timestamp does not necessarily describe a rate provider’s update time. If the rate interface has no timestamp, document that residual assumption rather than treating the aggregate timestamp as complete.

6. Do not substitute block time for observation time silently. A configuration that reports the current block timestamp can be useful for compatibility, but it changes what updatedAt means. Preserve per-feed timestamps and make the consumer’s staleness contract explicit.

7. Value the invariant, not a manipulable spot vector. Test large swaps and imbalanced states. Distinguish real fee accrual retained by the pool from valuation amplification caused solely by transient balance distortion.

8. Define unlocked-vault behavior. If balances can be read during a transient unlock or callback, test the in-flight state. An opt-in revert flag is only protection when every trusted deployment enables and preserves it.

9. Treat permissionless factory output as untrusted by default. A factory can validate lengths and interfaces yet still create instances with malicious pools, wrong feeds, unsafe flags, or unsupported price domains. Factory provenance is not an economic allowlist unless the integration enforces one.

10. Fuzz scale and permutation invariants. At minimum, test absolute price scaling, token/feed permutation, mixed decimals, rate-provider composition, extreme ratios, zero/negative answers, stale constituents, rounding bounds, and large balance distortion. Record failed initial assertions as evidence and explain whether they reveal a defect, legitimate fee growth, or immaterial rounding.

Evidence contract

A useful review returns:

• exact revision and deployment identity with uncertainty;
• all created instances and reachable consumers;
• a token/feed/decimal/rate/denomination table;
• timestamp semantics and residual freshness assumptions;
• completed and interrupted test logs distinguished honestly;
• confirmed findings or an explicit negative result;
• an integrity manifest.

This checklist is a review boundary, not a safety rating, audit certificate, price guarantee, or claim that any named protocol is vulnerable.