Abstract
Introduction
Decentralized finance (DeFi) applications depend on external oracle networks to obtain asset prices that drive core financial operations, including lending, collateral management, and automated liquidations. Oracle systems remain vulnerable to manipulation through coordinated strategies such as flash loan attacks and temporary price distortions in low-liquidity markets. Although several studies have addressed oracle manipulation, most existing approaches rely on single-source validation or detect attacks only after malicious activity has occurred, and few provide a continuous quantitative measure of oracle data trustworthiness.
Methods
This study proposes TOAD-ML, a trust-aware machine learning framework that evaluates the reliability of decentralized oracle price feeds using multi-source validation. TOAD-ML integrates data from five sources: labeled oracle attack events from DeFiHackLabs, CoinGecko historical market prices, Chainlink on-chain oracle rounds, Uniswap V3 TWAP pool data, and DeFiLlama multi-token aggregated prices. An XGBoost classifier is trained on engineered cross-source deviation and temporal features, augmented by a trust-calibration layer that produces a binary anomaly label and a continuous trust score bounded in [0,1]. The model is trained on 19 months of oracle price data encompassing four distinct, well-documented oracle hacks covering approximately 60 days of attack periods.
Results
Extensive empirical evaluation demonstrates 96.72% accuracy in identifying oracle price anomalies, with an AUC-ROC of 0.97. Ablation studies show performance reductions of 5.27% when multi-source fusion is removed and 3.84% when the trust-scoring layer is removed. TOAD-ML outperforms the baseline models: SVM (88.42%), Random Forest (91.76%), and standalone XGBoost (93.85%). These values are consistent with the reported experimental results.
Discussion
In case-study evaluation on documented oracle attacks, In the documented case studies, TOAD-ML signalled suspicious oracle behaviour before corresponding token price crashes. The framework provides early-warning capability, continuous trust quantification, and interpretable anomaly detection, supporting reliability-aware monitoring of DeFi oracle price feeds. The manuscript does not report an independent quantitative detection-latency benchmark; latency evaluation is identified as future work.