Oracle-free designs — replicating payoffs and Blend

1. TL;DR

Every incident in /oracles/oracle-manipulation/ happened because some contract had to ask an external source “what is this worth” — so a distinct line of design asks whether that question can be avoided entirely. Two genuinely different answers exist: a family of results showing that a large class of desired liquidity-provider payoffs (including many resembling options) can be built directly into a static, non-time-varying constant function market maker’s own trading function, with no oracle needed because arbitrageurs — not a price feed — keep the implied value correct; and Blend, a peer-to-peer NFT lending protocol that removes the oracle question altogether by never computing a collateral price at all, instead determining both interest rates and liquidation entirely through a continuous market of lenders willing to take over or exit a position. Neither approach eliminates risk — it relocates it, from “can the price be manipulated” to “which payoffs are mathematically reachable without an oracle” and “will anyone show up to the auction,” and as of 2026-08 both remain a minority pattern next to oracle-dependent designs.

2. Explain it simply

Analogy

A price oracle is like asking a stranger what your house is worth before deciding whether to lend against it — convenient, but you’re trusting the stranger’s honesty and their information. Blend instead runs a standing open house: your lender can, at any moment, invite other potential buyers to bid on taking over the loan, and if nobody wants it at any interest rate, that itself is the signal that the house isn’t worth what’s owed — no appraiser was ever consulted. The other approach, encoding a payoff directly into a trading pool’s own rules, is like designing a vending machine whose price-per-item automatically adjusts so that, no matter how the machine’s stock changes, the total value inside it always traces out exactly the deal you wanted to offer — nobody has to phone in today’s prices, because the machine’s own arithmetic (and the shoppers who exploit any mispricing) keeps it honest.

ELI5

Normally, a lending app needs a token or NFT’s price to decide if a loan is safe, and getting that price from outside the blockchain creates a way to cheat. Two different tricks avoid this. One builds the “deal” straight into a trading pool’s own math, so whatever it holds is automatically worth what was promised — arbitrage traders keep it honest by trading against it whenever it’s wrong, the same way they keep any pool’s price accurate. The other, used by an NFT lending protocol called Blend, skips prices entirely: instead of asking “what is this NFT worth,” it asks “is anyone willing to lend against it right now” — if nobody is, at any rate, the loan is treated as bad, no price lookup required.

Step-by-step walkthrough

Scenario: Bob borrows against his NFT using Blend, with lender Lucy, then Lucy exits via a refinancing auction — no price oracle appears anywhere in this sequence.

1. Before (state: Bob holds the NFT; Lucy holds 10 ETH and has signed an off-chain offer to lend up to 10 ETH at 20% APR against any NFT in Bob’s collection). Lucy decided her own terms from her own risk assessment — no external feed set her rate or loan-to-value.
2. Match. Bob finds Lucy’s offer and submits a transaction that locks his NFT in a vault with a lien and transfers Lucy’s 10 ETH to him.
3. Accrue. Interest accumulates continuously at Lucy’s quoted 20% APR; no oracle is consulted, since terms were fixed at origination.
4. Exit auction. Thirty days later, Lucy triggers a refinancing Dutch auction starting at 0% APR and rising over time — not pricing the NFT, only searching for the rate at which another lender takes over Bob’s debt.
5. After (state: new lender Nadia accepts at 35% APR, pays Lucy the full accrued repayment, and takes over as Bob’s lender). If no lender had appeared before Blend’s max rate, Bob’s position would be insolvent and Lucy would take the NFT — liquidation decided by absent market interest, never a price threshold.

Common misconceptions

• Myth: “Oracle-free” means “risk-free.” Reality: Both approaches trade oracle-manipulation risk for another risk — a mathematically limited set of replicable payoffs, or dependence on live auction participation.
• Myth: Any LP payoff can be built into a CFMM without an oracle. Reality: The framework requires the payoff be concave, nonnegative, nondecreasing, and 1-homogeneous — a long call’s convex payoff is outside this reachable set without leverage (Angeris, Evans & Chitra, 2021-03).
• Myth: Blend needs an oracle to determine whether a loan is underwater. Reality: It needs no price at all — insolvency is inferred from whether any lender, at any rate up to a max, is willing to refinance.
• Myth: Removing the oracle removes the need for sophisticated participants. Reality: Blend “assumes the existence of more sophisticated lenders” — the pricing intelligence an oracle provided moves entirely onto lenders.
• Myth: Replicating a payoff “without oracles” means without collateral or leverage too. Reality: The original result covers only unlevered payoffs; a follow-up extends the reachable set (capped calls, cash-or-nothing calls) by letting an LP sell individual components of their share, still with no oracle (Angeris, Evans & Chitra, 2021-11).

If you only remember one thing

An oracle-free design doesn’t make the “what is this worth” question disappear — it either bakes the answer directly into a trading function that arbitrageurs enforce, or replaces the question with “will a real lender act on this right now,” and each substitution has its own hard boundary.

3. How it works

Replicating a desired payoff directly into a trading function

A CFMM’s liquidity providers hold a claim whose value, as a function of external prices $c$, is a “portfolio value function” $V(c)$ — already established as necessarily concave, nonnegative, nondecreasing, and 1-homogeneous ($V(\eta c) = \eta V(c)$ for $\eta \ge 0$) for any path-independent CFMM (see /oracles/push-vs-pull-vs-twap/). Angeris, Evans and Chitra invert this: starting from any payoff $V$ satisfying those “consistent” conditions, they construct a feasible reserve set $S = \{R \in \mathbb{R}^n_+ \mid V(c) \le c^\top R,\ \forall c\}$ — reserve levels whose value, at every price, never falls below $V$ — and prove this set’s own payoff function is exactly $V$ again. They give an explicit trading function: $\psi_V(R) = \inf_c \left(c^\top R - V(c)\right)$, the negative Fenchel conjugate of $-V$, nonnegative exactly on $S$, usable directly as a CFMM invariant. No oracle appears: once $\psi_V$ is deployed, the same arbitrage mechanism that keeps any CFMM’s price honest automatically keeps the LP’s realized value tracking $V(c)$.

The paper is explicit about what this cannot do: since concavity is necessary, “impermanent loss… is an intrinsic property of liquidity provision in path-independent CFMMs” — a convex payoff like a long call option cannot be replicated this way without leverage or an oracle-settled side contract.

Extending the reachable set without oracles or leverage

A follow-up paper relaxes a hidden assumption: that an LP holds their full share or sells all of it. Letting an LP sell the right to withdraw individual components separately unlocks a richer class of monotonic (not necessarily concave) payoffs — capped calls, cash-or-nothing calls, logarithmic payoffs — with no added collateral and no oracle. As a striking special case, requiring an LP’s payoff to hold a constant proportion of value in each of two assets uniquely derives the constant-product invariant — Uniswap’s trading function — “from first principles.” This reframes how to evaluate a CFMM pool: ask what payoff its trading function actually replicates for you.

Blend: removing the price question entirely

Blend targets NFT-backed lending, where “individual NFT prices are very difficult to measure objectively” and even floor prices are hard to determine reliably on-chain. Rather than a better oracle, Blend removes price from the protocol’s core logic entirely. Loan terms are set by whatever a lender offers off-chain — no protocol parameter determines them. Loans have no fixed expiry, rolling forward indefinitely by default. When a lender wants out, they trigger a Dutch auction in interest-rate space, starting at 0% and rising until a new lender accepts (paying the outgoing lender the accrued repayment) or the auction hits a max rate with no takers, at which point the position is insolvent and the lender takes the collateral. Liquidation is a market-clearing question — did a lender show up — never a price threshold.

A formal comparison of what “no oracle” means in each case

For replicating payoffs, let $c$ be the reference price vector and $V(c)$ the LP’s target; $\psi_V$ guarantees the arbitrage-driven price matches $c$ at post-arbitrage reserves, so “no oracle” means no external price input is needed — arbitrage supplies the correction. For Blend, let $r(t)$ be the rate offered at auction time $t$, rising toward max $r_{\max}$; the loan is solvent if $\exists\, t^* < t_{\max}$ such that some lender accepts $r(t^*)$ — “no oracle” means no price is ever computed, since solvency depends only on whether $r(t^*)$ exists, not on any $c$.

4. Worked numeric example

Continuing Bob and Lucy’s loan from §2, using continuous compounding at Lucy’s quoted 20% APR over 30 days ($t = 30/365 \approx 0.0822$ years):

$\text{Repayment} = 10 \times e^{0.20 \times 0.0822} = 10 \times e^{0.01644} \approx 10 \times 1.01658 \approx 10.166 \text{ ETH}$

When Lucy triggers the refinancing auction, suppose the rate climbs from 0% and Nadia accepts at 35% APR after the auction has been running for a short time. Nadia pays Lucy the full 10.166 ETH repayment amount directly — no oracle-computed NFT valuation enters this transaction at all — and takes over the loan at the new 35% rate, with Bob’s outstanding debt now recalculated as 10.166 ETH principal accruing at 35% APR going forward. If, instead, the auction had reached Blend’s configured maximum rate (illustratively, 1000% APR) with no lender willing to take over even at that rate, the protocol would treat this as revealed insolvency — the market’s unwillingness to lend at any rate up to the ceiling is the entire liquidation signal, standing in for what a price oracle would otherwise have had to compute directly.

5. Where it’s used

Ethereum

• Blend (Blur) — peer-to-peer perpetual NFT lending with no oracle dependency, implemented by Blur Core Contributors; protocol fees and auction parameters governed by BLUR token holders after a 180-day timelock. paradigm.xyz/writing/blend
• Ondo Finance (as of the 2021 paper) — cited in “Replicating Monotonic Payoffs Without Oracles” as a live example of smart contracts that let liquidity providers securitize individual components of a CFMM position, the mechanism the paper’s replication method depends on.
• Uniswap and Balancer — both shown, in the replicating-payoffs literature, to be derivable rather than assumed: the constant-product and constant-mean invariants fall out of requiring a constant-proportion-of-value LP payoff, connecting these everyday AMMs directly to the oracle-free replication framework. See /exchange/cfmm-math/ and /exchange/stable-pools/.

Solana

• n/a — no Solana-native oracle-free lending protocol comparable to Blend found in these sources. Solana’s major money markets (Kamino, marginfi) rely on Pyth’s pull-oracle pricing (see /oracles/push-vs-pull-vs-twap/) rather than a Blend-style auction-based solvency mechanism.
• n/a — no Solana-native implementation of the CFMM payoff-replication framework documented in sources. The theoretical results are chain-agnostic, but the sources reviewed here describe only Ethereum-based implementations.

6. Risks, attacks, and incidents

• The reachable payoff set has a hard mathematical boundary. Concavity, nonnegativity, nondecreasingness, and 1-homogeneity are necessary, not just sufficient — a protocol marketing a CFMM as replicating a payoff outside this class (a convex, long-volatility payoff) without leverage or an oracle is making a claim the math can’t support.
• Replication is only guaranteed within a bounded price interval. The monotonic-payoffs paper states results hold “in a certain price interval” rather than universally — easy to miss when adapting the framework to a new use case.
• Impermanent loss is structural, not a bug to optimize away. Because concavity is required, LPs in any replicated design remain structurally short volatility — oracle-free replication changes which concave payoff an LP is exposed to, not whether they’re exposed at all.
• Blend’s liquidation mechanism depends on live market depth, not a formula. If a Dutch-auction refinancing attracts no lender because collateral is illiquid or the market is risk-off, the outgoing lender holds an NFT instead of cash — a real loss if its realizable value is below the debt it secured.
• Correlated lender withdrawal is a systemic risk unique to auction-based solvency. Blend has no circuit breaker analogous to a price threshold, so a broad, simultaneous loss of lender risk appetite could cause many refinancing auctions to fail near-simultaneously — not reported as having occurred, but not structurally ruled out.

7. Open problems

• Which payoffs remain fundamentally unreachable without an oracle. The original paper’s “Limitations” state convex payoffs require “the ability” to do something the static framework doesn’t provide alone — how far leverage-based extensions push the reachable set is open.
• How auction-based solvency performs under correlated stress. Whether Blend’s refinancing degrades gracefully or fails abruptly during a market-wide downturn isn’t addressed with historical evidence in these sources.
• Generalizing Blend’s model beyond NFTs. Blend targets collateral where oracles are unusually unreliable; whether the same auction-driven solvency model is worth adopting for fungible-token markets with liquid oracles isn’t addressed.
• Formalizing the arbitrage-profit cost of replication. The monotonic-payoffs paper provides “a simple formula for the total earnings of an arbitrageur,” implying LPs pay a quantifiable cost — a natural point of comparison to LVR (see /exchange/impermanent-loss-vs-lvr/) not elaborated further here.

8. Ethereum vs Solana

Aspect	Ethereum	Solana
Oracle-free lending	Blend (Blur) — live, NFT-focused, auction-based solvency	Not documented in sources; major money markets use Pyth
CFMM payoff replication	Theoretical framework with at least one cited live example (Ondo Finance, 2021 paper)	Not documented in sources
Dominant collateral type for oracle-free design	NFTs, where reliable price oracles are unusually hard to build	n/a
Where the “pricing intelligence” moves to, absent an oracle	Individual lenders’ own off-chain risk assessment (Blend) or arbitrageurs (replication)	n/a

The contrast here is less about chain-level architecture than about which problems each ecosystem’s dominant collateral types create: Ethereum’s NFT market produced Blend specifically because NFT price oracles are unusually unreliable, while Solana’s DeFi ecosystem, built primarily around fungible tokens with active Pyth-fed markets, has not generated a comparable oracle-free lending design in the sources reviewed.

9. Reference doc

The reference

Replicating Market Makers — Guillermo Angeris, Alex Evans, Tarun Chitra, 26 March 2021. arxiv.org/abs/2103.14769

Summary of the reference

The paper poses the inverse of the standard CFMM-analysis question: rather than starting from a trading function and deriving the liquidity provider’s resulting payoff, it starts from a desired payoff and asks whether a CFMM trading function exists that produces it. It proves the answer is yes if and only if the desired payoff function $V$ is “consistent” — concave, nonnegative, nondecreasing, and 1-homogeneous — establishing an equivalence between the space of such payoff functions and the space of convex CFMM trading functions. The construction proceeds by defining a feasible reserve set $S$ from $V$ (all reserve levels whose value never falls below $V$ at any price), proving $S$‘s own payoff function equals $V$ exactly via a strong-duality-style argument, and then giving an explicit trading function $\psi_V$ — the negative Fenchel conjugate of $-V$ — whose zero-superlevel set realizes $S$ directly.

The paper is explicit about why this matters practically: dynamically rebalancing a portfolio to replicate a payoff requires either continual on-chain trades (expensive, and exposed to Ethereum’s variable and sometimes high gas costs during volatile markets) or dynamically-adjusted CFMM weights that “require continual updates from on-chain oracles that may be expensive, complex to manage, and are often vulnerable to front-running attacks.” A static, oracle-free trading function sidesteps both costs: liquidity providers achieve their desired hedge passively, and arbitrageurs — who are incentivized to correct any mispricing relative to external markets regardless of the specific trading function in place — do the work of maintaining the hedge, at the cost of the LP’s exposure to arbitrage losses that fee income can partially offset. The paper also states its central limitation plainly: because concavity is required, the framework produces “negative gamma” payoffs (impermanent loss) intrinsically, and cannot, by itself, replicate the convex payoffs of long option positions.

Key quotes

“We show that the space of concave, nonnegative, nondecreasing, 1-homogeneous payoff functions and the space of convex CFMMs are equivalent.” (Abstract)

“These constructions require continual updates from on-chain oracles that may be expensive, complex to manage, and are often vulnerable to front-running attacks. In contrast, the trading functions we derive in this work are not time-varying and do not depend on external price oracles.” (Introduction)

“The concavity of the function implies that ‘impermanent loss’, also known as ‘negative gamma’ in finance, is an intrinsic property of liquidity provision in path-independent CFMMs, as it holds for any possible CFMM in practice.” (§1, Discussion)

“V must be concave, nonnegative, nondecreasing, and 1-homogeneous in order for there to exist a CFMM trading function with V as its liquidity provider payoff.” (§1, Desired payoff)

How to read the original

Background needed: convex analysis fundamentals (Fenchel conjugates, subgradients, supporting hyperplanes) and the CFMM reported-price framework from /oracles/push-vs-pull-vs-twap/, since this paper is explicitly its inverse problem. Skip the full worked derivations of specific trading functions for options and swaps in the later sections on a first pass — the core existence-and-construction result (§1.1) carries the paper’s argument. The hardest part is internalizing why 1-homogeneity, which looks like a technical restriction, is actually unavoidable: it’s not an assumption chosen for convenience, but a necessary property of any CFMM’s payoff function (proven early in the paper), meaning no construction method — this one or any other — could ever produce a CFMM replicating a payoff that violates it.

The reference

Blend: Perpetual Lending With NFT Collateral — Dan Robinson, transmissions11, Galaga, Toad, Pacman (Paradigm), 1 May 2023. paradigm.xyz/writing/blend

Summary of the reference

The paper motivates Blend by observing that NFT-backed lending protocols existing at the time all made compromises the authors found avoidable: oracle-dependent designs struggle because “individual NFT prices are very difficult to measure objectively” and even floor prices are hard to measure reliably on-chain; fixed-expiry designs create gas costs and user-error risk around manually rolling positions; non-liquidatable designs force lenders to demand worse terms upfront to compensate for the risk of not being able to exit; and pooled designs require heavy on-chain governance or centralized risk management to support long-tail collateral safely. Blend’s design responds to each in turn: no oracle dependency (loan terms come entirely from peer-to-peer offers), no fixed expiry (loans roll forward automatically until someone acts), liquidatable at any time via a refinancing auction, and peer-to-peer rather than pooled (each loan matched individually, assuming sophisticated lenders willing to evaluate risk themselves).

The mechanism is built up incrementally: a simple fixed-term loan (lender offers terms off-chain, borrower matches and locks NFT collateral) is extended with a Dutch-auction-in-interest-rate-space refinancing mechanism to avoid forcing a lender to seize collateral just because a borrower forgot to repay by expiry, then further extended with an “optimistic auction” default (loans silently roll forward at the same terms unless a party actively wants a change) and finally generalized to continuous, expiry-free loans by shrinking the loan period to an infinitesimal duration — at which point a lender can trigger a refinancing auction at any moment they become concerned about collateral safety, rather than only at a fixed rollover date. Liquidation occurs precisely when a refinancing auction reaches its maximum configured interest rate with no lender willing to take over the position — a market-based signal of insolvency that substitutes entirely for a price-based liquidation threshold.

Key quotes

“Blend has no oracle dependencies and no expiries, allowing borrowing positions to remain open indefinitely until liquidated, with market-determined interest rates.” (Overview)

“Individual NFT prices are very difficult to measure objectively. Even floor prices tend to be difficult to measure on-chain. Solutions often either involve a trusted party, or could be manipulated with trading strategies.” (No Oracles)

“Once the auction hits some defined max rate (like 1000%) without any new lender stepping in, the protocol infers that the position is insolvent or otherwise non-viable, and liquidates the borrower.” (Liquidation)

“Blend uses a peer-to-peer model where each loan is matched individually… Blend assumes the existence of more sophisticated lenders capable of participating in complex on- and off-chain protocols, evaluating risks, and using their own capital.” (Peer-To-Peer)

How to read the original

Background needed: what a Dutch auction is (a price or rate that moves monotonically until someone accepts it) and roughly how a standard fixed-term collateralized loan works. Skip the exact governance-parameter list under “Governance Considerations” on a first pass — it’s implementation detail specific to Blur’s deployment, not the mechanism itself. The hardest part to follow is the “Continuous Loans” section’s leap from a fixed loan period to an infinitesimal one: it’s easy to read this as a hand-wavy limiting argument, but the concrete payoff is precise — by removing the concept of a scheduled expiry entirely, any lender concern about collateral safety becomes actionable immediately via the same refinancing-auction mechanism already described for scheduled rollovers, rather than requiring a separate emergency-liquidation code path.

What changed since

• Blend’s design has been implemented in production by Blur; BLUR governance controls fee and auction-formula parameters after a 180-day timelock, a centralization tradeoff the original paper flags explicitly rather than resolving.
• The monotonic-payoffs-without-oracles follow-up (2021-11, same lead authors as the Replicating Market Makers paper) substantially extends what payoffs can be replicated without an oracle, though it addresses AMM liquidity-provider payoffs specifically rather than Blend’s lending-solvency problem — the two “reference” papers on this page solve structurally different oracle-avoidance problems that happen to share a research lineage.
• No source reviewed here documents a large-scale stress test of Blend’s refinancing-auction liquidation mechanism during a correlated, market-wide downturn, leaving the open problem noted in §7 unresolved as of these sources.

Secondary references

1. Replicating Monotonic Payoffs Without Oracles (Angeris, Evans & Chitra, arXiv, 2021-11) — read next for the richer, non-concave payoff class (capped calls, binary options) reachable by selling individual share components, and for the from-first-principles derivation of the constant-product invariant.
2. So you want to use a price oracle (samczsun, Paradigm, 2020-11) — read for the specific manipulation incidents (/oracles/oracle-manipulation/) that motivate wanting an oracle-free design in the first place.
3. Improved Price Oracles: Constant Function Market Makers (Angeris & Chitra, arXiv, 2020-03) — read for the arbitrage-driven reported-price mechanism this page’s replication framework depends on and inverts.

10. Sources

• Replicating Market Makers — Guillermo Angeris, Alex Evans, Tarun Chitra — 2021-03-26 — https://arxiv.org/abs/2103.14769
• Replicating Monotonic Payoffs Without Oracles — Guillermo Angeris, Alex Evans, Tarun Chitra — 2021-11-26 — https://arxiv.org/abs/2111.13740
• Blend: Perpetual Lending With NFT Collateral — Dan Robinson, transmissions11, Galaga, Toad, Pacman (Paradigm) — 2023-05-01 — https://www.paradigm.xyz/writing/blend
• Improved Price Oracles: Constant Function Market Makers — Guillermo Angeris, Tarun Chitra — 2020-03-22 — https://arxiv.org/abs/2003.10001
• So you want to use a price oracle — samczsun (Paradigm) — 2020-11-09 — https://www.paradigm.xyz/writing/so-you-want-to-use-a-price-oracle