A lending contract has no way to observe prices on its own. Everything it does about collateral value depends on a feed supplied from outside, which makes that feed the load-bearing part of the design.
A contract only sees what is written to it
Smart contracts execute deterministically over chain state, and exchange prices are not part of that state. Some component has to write the number in before the contract can act on it.
Oracles are the contracts and reporters that perform this job, publishing a value that lending markets, derivatives venues and stablecoins then read as truth.
Everything downstream inherits the quality of that number. If a collateral asset is reported at the wrong value, the lending contract will happily lend or liquidate against it.
Two failure directions, both costly
A price reported too high lets a borrower draw more than their collateral supports, and the shortfall becomes bad debt that suppliers ultimately absorb.
A price reported too low triggers liquidations on positions that were never actually undercollateralised, handing borrowers' assets to liquidators at a discount they did not deserve.
Both failures are irreversible once executed on chain, which is why oracle design receives attention out of proportion to how small the component looks in an architecture diagram.
Manipulation targets the thinnest source
An oracle that reads the spot price from a single trading venue can be pushed around by anyone willing to trade heavily in that venue for a moment.
Where the venue is a shallow on-chain pool, the trade and the exploit can be bundled into one transaction, so the price is moved, borrowed against and restored before anyone can react.
Defences follow from that. Feeds average across multiple venues, weight by traded volume, or use a time-weighted value that a single block cannot shift far enough to matter.
Freshness and staleness pull against each other
Smoothing a feed over time makes manipulation expensive, but it also means the reported price lags a genuine market move.
During a fast decline, a lagging feed shows collateral as healthier than it is, and liquidations start late. That delay is exactly when bad debt accumulates.
Protocols therefore tune update frequency, deviation thresholds and heartbeat rules per asset, accepting more lag on assets that trade thinly and less on those with deep, continuous markets.
Derived assets inherit an extra layer
Many collateral types are not traded directly but derive their value from something else, such as a staked receipt token that accrues rewards against an underlying coin.
Pricing these from a market quote invites trouble, because a thin secondary market can trade at a discount that has nothing to do with the redemption value.
The safer construction reads the exchange rate from the issuing contract and multiplies it by the price of the underlying, which keeps the valuation tied to the asset that actually has a deep market.