Oracle Health Explorer

Protocols rarely lose money because an oracle was attacked. They lose it because the consuming contract called latestRoundData(), took the answer, and used it — and the answer was old, or negative, or from a round that never finished. This page reads live Chainlink Data Feeds through a contract on Base Sepolia that performs those checks and names the result.

Base Sepolia · testnet only

This demo is read-only. There is no wallet to connect and nothing to sign: every function on the contract is a view, so the whole page is built from eth_call. You will not be asked for a signature and you will not spend any gas. The page also takes no input at all — there is no field, no slider and no query parameter — so nothing you send can change what it reads.

Checker 0x401a…CdB0 · Deployed in block 44827955, tx 0xa306…8578 · Source on GitHub

---

The six things that can be wrong

A price feed does not usually fail by disappearing. It fails by continuing to answer, politely, with something a consumer should not act on. The contract distinguishes six states, and the order matters: they are declared least to most severe, and when more than one is true at once a consumer is told the worst of them rather than whichever the code happened to check first.

What the chain says right now

Every figure below is read from the deployed contract on each page load: the verdict, the round data it was derived from, and the threshold it was judged against. Nothing here is a number this page decided. The raw values are shown beside each verdict so you can redo the arithmetic instead of trusting it.

Read at block 45526629. Worst state across all feeds: Healthy.

---

Why the thresholds are not the same number

Each feed is judged against its own max age, fixed at deployment. That is a measurement, not a preference.

The three crypto feeds above republish every few minutes, driven by price deviation. USDC / USD does not: it moves on a roughly 24-hour heartbeat, confirmed across two consecutive intervals before this contract was written. A single estate-wide threshold cannot describe both. Tight enough for BTC, and USDC reads stale for almost all of every day. Loose enough for USDC, and a BTC feed frozen for twenty hours reads healthy. Neither of those is a staleness check.

So the threshold lives with the feed, and it is immutable — there is no owner, no setter and no upgrade path, which is why the max age shown in each table above is read from the contract rather than written into this page.

The boundary is the bug

maxAge is inclusive. An age of exactly maxAge is healthy; stale begins one second later. The comparison is age > maxAge, never >=.

That single character is the whole bug class, and it is invisible to testing that samples the middle of a range — both wrong versions agree with the right one everywhere except on one value. So the property harness constructs both sides of the threshold on every run rather than waiting to stumble onto it, and a companion test demonstrates that an interior sample does not catch the substitution.

A check that is still copied, and cannot fire

Older Chainlink documentation suggested guarding staleness with answeredInRound < roundId, and that line is still copied into consumer code today. All four aggregators here still expose answeredInRound — and on every one of them it comes back equal to roundId, so the guard can never fire.

The contract documents that in a comment instead of implementing it. A check that always passes is worse than no check: it reads as though staleness were covered when the only thing actually covering it is the updatedAt comparison.

How it is verified

The contract passes the Pigfox Solidity pipeline on every push: forge lint and Solhint, formatting, build, tests, 100% line, statement, branch and function coverage with no exclusions, Slither at fail-on: low, and property fuzzing under both Echidna and Medusa.

Nine properties are claimed. The verdict logic is a pure function — it takes the round data and the observation time as arguments and reads neither state nor clock — which is what makes them provable at all: a live aggregator cannot be asked to go stale, answer negative, or hand back an incomplete round, so those states are reached with mock feeds built from source inside the fuzzers’ own in-process EVM.

1. a verdict is always the most severe applicable state
2. time passing never makes a verdict healthier
3. a complete, positive, in-date round is healthy
4. a non-positive answer is never healthy, at any age
5. an incomplete round is reported as one
6. a future timestamp is reported as one
7. the staleness boundary is exact in both directions
8. an unreadable feed yields UNAVAILABLE and never reverts the caller
9. reading a real feed agrees with the pure logic on the same numbers

The property count is declared, not counted: the harness states it as a literal, a static gate counts the predicates, and each fuzzer is checked against what it actually registered at runtime — so a property that quietly stops being picked up fails the build instead of reporting a smaller green run. The harness’s own detectors are tested too, by installing a checker built to break each property and requiring the matching predicate to notice, with a control that requires a faithful checker to trip nothing. Full detail, including the measured heartbeats and the live read-back, in the repository.