AMM Design in 2026: When the Curve Becomes the Oracle

On 30 August 2026, the Cronos blockchain did something a settlement layer is not supposed to be able to do. It stopped, backed up, and behaved as though the previous twenty minutes had never happened. Validators halted the chain and discarded roughly 11,000 blocks to erase a $75 million exploit of the lending market Tectonic, restoring balances to a point before the attack, according to CoinDesk. The trigger was not a stolen key or a broken line of code. It was a price. An attacker had pushed the thinly traded TONIC token up by about 100 times in twenty minutes, then borrowed real assets against the inflated collateral before anyone could react.

The price that attacker moved lived inside an automated market maker. That is the part worth sitting with. An AMM is not only a place to trade; it is also a machine that publishes a number, and that number gets read by lending markets, derivatives platforms, stablecoins, and liquidation bots across the chain. When you design the curve that prices a swap, you are also designing a price feed, whether you meant to or not. This article is about that second job, the one AMMs were never advertised for and keep failing at in expensive ways.

Most of the year’s largest crypto losses fall into two families. One is the stolen key, where the code did exactly what it was told and the attacker simply held the signing keys, the theme of our look at 2026’s biggest key heists. The other is the manipulated price, where nothing was stolen and no bug was triggered: a protocol read a number, believed it, and paid out. Oracle manipulation is the cleanest example of the second family, and the AMM sits at the center of it.

We are going to follow that price. From the moment a pool quietly becomes a data source, through the attacks that keep draining the protocols reading it, the defenses that raise the cost of a lie (time-weighting, geometric means, per-block caps), and the external oracles built to replace the curve, down to the harder questions underneath: what happens when even a correct price leaks value, and whether a chain that can rewind a bad price is really a market at all.

How a swap became a data source

The earliest automated market makers did one job. Uniswap’s original pools quoted a price straight from their reserves using the constant-product rule, the famous x times y equals k, an idea Vitalik Buterin sketched publicly in early 2018 and Hayden Adams shipped as Uniswap later that year. The price was a side effect of the balances in the contract. Nobody set it; the pool simply was whatever ratio its two token balances implied.

The turn came in May 2020, when Uniswap V2 added an on-chain time-weighted price oracle. Each pool began recording a running cumulative price once per block, so any other contract could read the pool’s average price over any window it chose, entirely on-chain, with no off-chain reporter and no API key, per the Uniswap documentation. The pitch was irresistible for a trust-minimized system: a censorship-resistant price feed that lived inside the same contracts everyone was already trading against.

That is the moment every pool became a candidate oracle. Lending markets could value collateral from the same venue where it traded. Newer tokens with no professional data feed suddenly had a price source that existed at all. Composability did the rest; if a number is on-chain and free to read, something will read it. The catch is the sentence the next six years kept proving: a price that anyone can move by trading is a price that anyone can move by trading.

The reserve ratio is not a price

It helps to be precise about what an AMM actually publishes. On a constant-product pool, the instantaneous price is just the ratio of the two reserves at that instant, the marginal rate at which the curve will trade the next tiny amount. It is not a consensus, not a survey of the market, not a volume-weighted figure. It is the state of one pool at one moment, and the curve is built to let that state move as people trade.

Picture a pool holding 100 ETH and 250,000 USDC, quoting ETH near $2,500. A trader who buys a large share of that ETH in a single transaction walks the price up the curve, because each unit of ETH removed makes the next one more expensive; by the end of the swap the pool might be quoting a multiple of where it started. That is not a bug. It is the AMM working as designed. The bug appears only when some other contract reads that mid-transaction price and treats it as the fair value of ETH.

Flash loans removed the last barrier. Because a borrower can take millions with no collateral as long as the loan is repaid inside the same transaction, an attacker can borrow a fortune, use it to shove a pool’s price wherever they want, exploit a downstream protocol that trusts the shoved price, and repay the loan, all atomically, risking almost nothing. This is the recipe behind the very first wave of these attacks in early 2020, when bZx was drained through manipulated Uniswap and Kyber prices, as CoinDesk documented at the time.

The error, strictly speaking, is never in the AMM. It is in the consumer that mistakes one pool’s instantaneous reserve ratio for a valuation. But because the AMM is the thing that publishes the number, AMM design and oracle design stopped being separable problems.

A short history of manipulated curves

The list of protocols burned by trusting an AMM price is long, repetitive, and spread across six years. The mechanisms vary in the details; the shape almost never does.

Read the table top to bottom and the lesson is dull, which is exactly why it keeps happening. None of these required a novel exploit. Each one was a valuable protocol trusting a price a shallow market could move, whether that price was a raw spot rate or, in the Inverse Finance case, a time-weighted average that was simply not robust enough. Six years apart, bZx and Tectonic are the same trade with different logos.

TWAP, or buying time as a defense

The first real defense was to stop reading the price at a single instant. A time-weighted average price, or TWAP, averages a pool’s price across a window of time, so a one-block spike barely moves the number. To shift a TWAP an attacker has to hold the manipulated price across many blocks, and for every block they hold it, arbitrageurs are paid to trade against them and drag it back. The cost of the attack scales with the length of the window. Time became the moat.

Uniswap V2 implemented this with a cumulative price accumulator: read the accumulator at the start and end of your window, subtract, divide by the elapsed seconds, and you have the average. Uniswap V3, in May 2021, made it sturdier with a geometric-mean TWAP built from cumulative ticks stored in each pool. Because V3 records prices as ticks, where each tick is a 1.0001 step, averaging the ticks and converting back yields a geometric mean that quietly discounts a single wild print; to drag the average, an attacker has to drag spot to a genuinely absurd level, as the same Uniswap documentation describes.

This worked. The clean one-block flash-loan recipe stopped functioning against protocols that read a long TWAP instead of raw spot, and for a while the problem looked solved. But a TWAP is a cost multiplier, not a wall, and it has two soft spots that 2026 keeps pressing on: shallow pools and time itself.

Inverse Finance is the shallow-pool lesson. It did read a time-weighted price, and still lost about $15.6 million in April 2022, because the INV pool was thin enough for a well-funded attacker to hold the manipulated level and the sampling window was too short to punish them, per CoinDesk. A TWAP over a thin pool is just a slower, more expensive version of the same weakness, not a cure for it.

What the Merge did to the oracle

The other soft spot, time, got structurally worse in September 2022, when Ethereum switched from Proof of Work to Proof of Stake. The change quietly rewrote the economics of holding a manipulated price.

Under Proof of Work, no one knew who would produce the next block, so a manipulator could not be certain of executing their manipulation and their reversal in sequence without an arbitrageur slipping in between and taking the profit. That uncertainty was itself a defense. Under Proof of Stake, validators learn their block assignments up to roughly twelve minutes in advance, and a validator who draws two blocks in a row can act with no one able to intervene between them.

Uniswap Labs said the quiet part directly in its own analysis of V3 oracles under Proof of Stake: “A validator controlling two consecutive blocks can greatly move the price of a pool in the first block and move it back in the next block without risk of being arbitraged against,” per the Uniswap blog. That risk-free two-block window is precisely the thing a TWAP assumed could not exist.

Depth is what still saves the deep pools. In the same analysis, moving the deep USDC/WETH pool by 20% across two blocks would cost on the order of $710 billion, which is not a real attack; stretch the manipulation to three blocks and the cost collapses to roughly $978 million, still large but no longer fantastical. And a validator holding 10% of all stake would be handed three consecutive blocks around 181 times a month. The takeaway for a designer is uncomfortable: a geometric-mean TWAP over a very deep pool remains hard to fake, but the safety margin narrowed after the Merge, and on the thin pools where manipulation actually happens it can be gone entirely.

The capital-efficiency paradox

Here is the tension that sits under every AMM-oracle decision in 2026: almost everything that makes an AMM a better market makes it a worse oracle.

Concentrated liquidity, the V3 innovation now copied everywhere, lets liquidity providers stack their capital into a narrow band around the current price. Traders get deep liquidity and tight pricing exactly where they trade, which is wonderful for execution. But it also means the pool is thin just outside that band, so shoving the price to an extreme, the whole point of a manipulation, can be cheaper than it would have been in an old full-range pool holding the same money. Capital efficiency for the trader is fragility for the oracle reading the same pool.

The harder problem is coverage. Aggregated oracle networks cover the assets that matter to institutions: the majors, the large caps, the deeply traded pairs. They do not cover the long tail, the governance token that launched last week, the memecoin with a day of history, the freshly listed pair with one shallow pool. For those assets the only on-chain price that exists is the AMM, and usually a shallow one. So the tokens most dangerous to price are exactly the ones with no alternative to the curve. Tectonic’s TONIC and Mango’s MNGO both lived in that gap.

This is why the glib answer, just use a real oracle, is incomplete. The oracle of last resort for most of the token universe is still an automated market maker, and the AMM is thinnest precisely where the stakes are highest. Lending markets are the biggest consumers of these numbers; if you have ever borrowed against your crypto, a feed like this set your collateral’s value and drew the line where you get liquidated.

The external-oracle answer: Chainlink, Pyth, and the rest

For assets that do qualify, most serious protocols moved off raw AMM prices years ago and onto dedicated oracle networks. Two broad designs split the market.

Chainlink uses a push model. A decentralized set of node operators gathers prices from many venues off-chain, both centralized exchanges and DEXs, takes a median, and pushes the aggregated number on-chain when it moves past a threshold. A median of many independent sources is far harder to move than any single pool, which is why blue-chip lending markets default to it. By late 2025 Chainlink secured close to two-thirds of all oracle value, roughly $33 billion across some 505 protocols, according to a 2026 oracle comparison from RedStone.

Pyth uses a pull model. First-party publishers, trading firms and exchanges, sign their prices, and a consumer pulls the latest signed price on-chain at the moment it needs one, paying the update cost itself. The low latency, updating roughly every 400 milliseconds on Solana, made Pyth popular with perpetuals and other derivatives, where a price that is even a second stale is a real liability. RedStone, Chronicle and a handful of others fill further niches.

But notice what every one of these shares. They reintroduce some trust in reporters, and they draw a coverage boundary. If your asset is not on their list, and most of the long tail is not, you are back to reading the curve. The external oracle solved the blue-chip problem and left the dangerous edge of the market exactly where it was.

Designing the manipulation out: Uniswap V4 oracle hooks

The most interesting move of 2026 is not to abandon the AMM oracle or to import an external one, but to make the AMM itself hard to manipulate by construction. Uniswap V4’s hooks, small pieces of custom code that run at key moments in a pool’s life, made that possible.

The clearest example shipped as the truncated oracle hook. It still records a geometric-mean price, but it caps how far the recorded tick can move within any single block. If the pool’s tick jumps more than 9,116 ticks in one block, which is about a 2.5x move in price, the oracle only writes down a move of that capped size, according to the Uniswap V4 truncated oracle documentation. An attacker can still spike the tradeable spot price for a single swap, but the feed simply refuses to believe more than a bounded jump per block.

The effect is to rebuild the multi-block moat that Proof of Stake had eroded, this time inside the pool rather than relying on outside arbitrage. As Uniswap’s own description puts it, an attacker “would have to sustain their manipulation over many blocks,” paying the cost the entire time. It does not fix thin liquidity, and it is opt-in rather than automatic, but it is a direct, on-chain answer to the consecutive-block problem, and it points at where AMM design is going: the manipulation cost becomes a parameter the pool sets, not an accident of the market.

Even a correct price leaks value

Now suppose you win the manipulation fight completely. Your oracle reports the true price at every moment, unfakeable. You still have not made it safe, because the update itself is worth money.

Oracle extractable value, or OEV, is the MEV created purely because an oracle posted a new price. In a lending market, an update that crosses a liquidation threshold sets off liquidations, and searchers race to grab the liquidation bonus; that value is extracted from borrowers and the protocol, and it exists only because the number changed. Cumulative OEV leakage across DeFi has already passed $500 million, according to Chainlink’s own documentation on the problem.

The 2026 response is to auction the update rather than let it leak. Chainlink’s Smart Value Recapture routes an oracle update through a sealed-bid auction in which searchers bid for the right to act on it, and returns most of the proceeds to the protocol; it launched in December 2024 and went live on Ethereum with Aave in March 2025. UMA’s Oval, built with Flashbots, wraps a Chainlink feed in an order-flow auction and shares the winnings with the protocols consuming the data. UMA co-founder Hart Lambur, introducing Oval, framed OEV as revenue that protocols should be capturing rather than quietly surrendering to bots, per the UMA project’s announcement.

For design, the shift is conceptual and large. A price feed is no longer a passive number that contracts read for free; it is a scarce event with a market around it. Good AMM-oracle design in 2026 has to ask not only whether the number is right, but who gets paid at the instant it changes.

The consumer’s problem: whoever reads the curve

Every one of these attacks is a two-party failure. The AMM publishes a movable number, and a consumer trusts it more than the pool’s liquidity can justify. The AMM half of the problem gets the research papers, but the consumer’s design choices are what decide whether a movable price turns into a nine-figure hole.

Lending markets are the primary readers, and the disciplines that separate the survivors from the headlines are unglamorous:

• Conservative collateral factors on illiquid assets. Tectonic assigned its own thinly traded governance token a 20% collateral factor, which let a borrower draw a fifth of a valuation the market could never have supported, according to CoinDesk. For most long-tail tokens the honest factor is zero: do not accept them as collateral at all.
• Dual oracles and sanity bounds. Read two independent price sources, and reject a trade or freeze a market when they diverge past a set threshold; cap how fast a reported price is allowed to move between blocks.
• Borrow caps and circuit breakers. Limit how much can ever be borrowed against any single asset, so that even a fully successful manipulation is bounded to a survivable size.

None of this is exciting, and none of it removes the underlying weakness, which is that a determined actor can always move a thin price. What it does is convert an unbounded loss into a bounded, budgeted one. That is the whole job.

The rollback question

Tectonic did not end with any of those defenses. It ended with a rewind. Cronos validators halted the chain and rolled back roughly 11,000 blocks to erase the exploit, and user funds were saved because the previous twenty minutes were simply deleted from history, as CoinDesk reported.

That worked, and it reopened a debate the industry thought it had retired years ago. Is a chain that can undo a $75 million loss really immutable, and if it can undo this, what exactly can it not undo? Our colleagues examined that specific question in the story of the $75 million rewind, and the tension is real.

For AMM-oracle design the lesson is narrower and sharper than the philosophy. If your final line of defense against a manipulated price is asking validators to agree that it never happened, then you did not design a price feed; you outsourced it to social consensus. The entire selling point of an on-chain oracle was trust minimization. A rollback is the exact opposite, and needing one is a confession that the design underneath failed.

Where the law lands: manipulation without a crime

If the code will not always stop it and the chain should not have to rewind it, perhaps the law can deter it. The record there is discouraging.

Mango Markets is the test case. In October 2022 Avraham Eisenberg drained about $110 million by inflating the MNGO oracle, and he publicly described his actions as a legal, highly profitable trading strategy that used the protocol as designed. He was convicted of fraud and market manipulation in 2024. Then, in May 2025, a federal judge in the Southern District of New York vacated every one of those convictions, finding that prosecutors had not established proper venue in the district and had not proven the misrepresentations the charges required, as TRM Labs detailed.

The regulatory picture around it stayed deliberately murky; both the SEC and the CFTC claimed a piece of the case, and the criminal conviction ultimately collapsed on a question of geography. For a protocol designer the point is not which agency prevails. It is that you cannot litigate your way to a safe oracle. Deterrence after the fact is slow, uncertain, and jurisdictionally fragile, and the only dependable defense is to make the manipulation too expensive to attempt in the first place. The larger fight over how these assets are even classified, the commodity-or-security gate that decides which regulator has standing at all, is still grinding through the CLARITY and Fed calendar in Washington this September, and it will not price a single pool for you.

What good AMM-oracle design looks like in 2026

Pull the threads together and the through-line of six years of losses is almost embarrassingly simple. An AMM publishes a price, and someone downstream trusts it more than its liquidity deserves. Every genuine defense is a way of pricing in the cost of a lie.

A designer building on AMM prices in 2026 has a checklist that would have prevented most of the table above:

• Read time-weighted, geometric-mean prices, never raw spot.
• Favor pools deep enough that moving them is genuinely expensive, and truncated-oracle hooks that cap per-block moves by construction.
• For assets that qualify, aggregate off-chain with a network like Chainlink or pull signed feeds like Pyth, and cross-check two independent sources before acting.
• For the long tail with no real feed, be honest about it: low or zero collateral factors, strict borrow caps, and the working assumption that the price can and will be moved.
• Recapture the value the update itself creates, through SVR or Oval, instead of leaking it to searchers.

The larger arc is that the AMM has stopped being merely a place to trade, or even merely a feed. With Uniswap V4’s hooks it became programmable market infrastructure, where the pricing curve, the manipulation cap, and the value of each price update are all parameters a builder sets on purpose. The oracle is no longer something that happens to a pool; it is something a pool is designed to be.

Uniswap founder Hayden Adams has argued that “AMMs are only just getting started,” rejecting the idea that the model has run its course, in comments reported by CryptoPotato. The oracle problem is a large part of what is still unfinished. The curve turned out to be easy to build and hard to trust, and the best work of 2026 is the patient, unglamorous project of making an on-chain price expensive enough to believe.

Frequently Asked Questions

What is an AMM oracle?

An AMM oracle is the use of an automated market maker’s pool price as a data source for other smart contracts. Because a pool always quotes a price from its reserves, any contract can read it, but a raw spot price reflects only one pool at one instant and can be moved by a single large trade, which is why safer designs read a time-weighted average instead.

How do attackers manipulate AMM price oracles?

They move a pool’s price and get a downstream protocol to trust the moved number. A common recipe uses a flash loan: borrow a large sum with no collateral, swap it to push a pool’s price up or down, exploit a lending market that reads that price as collateral value, then repay the loan, all in a single transaction. Thinly traded tokens are the usual targets because their prices are the cheapest to move.

Are TWAP oracles safe from manipulation?

They are much safer than spot prices but not immune. A time-weighted average forces an attacker to hold a manipulated price across many blocks while arbitrageurs trade against them, which raises the cost sharply on deep pools. On thin pools, with short windows, or when a Proof of Stake validator controls consecutive blocks, TWAPs can still be moved, as the roughly $15.6 million Inverse Finance loss showed.

What is the difference between Chainlink and an AMM oracle?

An AMM oracle derives a price from one on-chain pool’s reserves, while Chainlink is a separate network whose node operators aggregate prices from many venues off-chain, take a median, and push the result on-chain. The median-of-many approach is much harder to manipulate, which is why blue-chip lending markets prefer it, but it only covers listed assets, so long-tail tokens still fall back to AMM prices.

What is oracle extractable value (OEV)?

OEV is the value created at the instant an oracle posts a new price, most visibly the liquidations that a price update triggers in lending markets and the bonuses searchers race to capture. It has cost DeFi more than $500 million cumulatively. Newer systems such as Chainlink’s SVR and UMA’s Oval auction that update so the value flows back to the protocol instead of leaking to bots.

Yuki Tanaka is a DeFi correspondent at HOGE Wire, covering market structure, on-chain infrastructure, and the mechanics of decentralized trading.