How a fund's price gets on-chain

Why a blockchain needs an oracle

A blockchain is a machine that thousands of computers run in lockstep, so every one of them must reach the same result from the same inputs. A contract that asked a website for a price would break that rule, because two computers asking a second apart could get two answers. So contracts read only what has already been written into the chain.

An oracle is the service that writes a number from outside the chain into a contract that other contracts can read. Chainlink's Data Feeds are the best-known example: a network of node operators agrees on a price and posts it to a contract, and lending protocols read it from there. The oracle moves data. It does not create it.

This matters because a contract acts on whatever number it is given with the same certainty. If a feed says a token worth 0.86 USD is worth 1.06 USD, the lending market will lend against 1.06 USD, which is what happened in the Stream Finance collapse described at the end of this chapter.

What NAV is and who computes it

NAV, net asset value, is what one unit of a fund is worth: total assets minus liabilities, divided by the units outstanding. A fund administrator is the firm that keeps a fund's books under fund accounting rules and strikes that official number. For BlackRock's BUIDL it is BNY Mellon, which is also the custodian.

Securitize, the tokenization platform behind BUIDL and other funds, puts the division of labour plainly in its 2026 SEC filings: it uses oracle providers to deliver NAV to smart contracts, and the NAV itself comes from the fund administrator or the transfer agent. A perfect oracle network will still carry a wrong number if the administrator computes it wrong or publishes it late. Decentralizing the oracle protects the number in transit and says nothing about how it was made.

This also breaks the standard oracle recipe. For a crypto asset, a provider takes prices from ten exchanges, drops the outliers and publishes the median. A private credit fund has no exchange price. It has one valuation from one administrator, and ten copies of that valuation are one source copied ten times.

Two more distinctions catch analysts out. Daily publication is not daily valuation: private credit is classically valued once a quarter, and a daily feed between those marks can be interpolation plus accrued interest. Daily NAV is also not daily liquidity. Apollo's ACRED fund strikes a daily NAV, yet it redeems quarterly and caps each redemption window at 5% of the fund.

Push, pull and the freshness trap

There are two ways to deliver a number, and they fail differently.

A push feed stores a value in a contract, where it sits until the provider writes a new one. A consumer calls a function such as latestRoundData() and gets the value plus updatedAt, the time it was written. A pull feed keeps the data off-chain as a signed package, and whoever needs it attaches the package to their own transaction, where a contract checks the signatures. Pyth works this way.

A push feed writes for one of two reasons. A heartbeat is the maximum idle time, after which the provider writes whatever the price did. A deviation threshold is the size of move that triggers an early write. The asset sets the spacing, as two reserve feeds published by Spark in July 2026 show.

The trap sits with the consumer. Chainlink's documentation tells applications to check updatedAt themselves and stop if the value is too old. A stale feed raises no error. It returns an old value with a truthful old timestamp, and only a consumer that reads the timestamp can tell.

An oracle that was 225 days old

On 4 September 2026 at 11:08 UTC I read eight NAV and rate oracle contracts on Ethereum. Six were LlamaGuard contracts carrying NAV and risk data for tokenized funds, and two were Pendle rate feeds. All eight use Chainlink's standard interface, so from a consumer's side they look exactly like a Chainlink feed.

Most showed a daily rhythm. The JAAA and JTRSY feeds had been written 3.8 hours earlier, and USYC and USTB about 21 hours earlier, consistent with a write each business day.

Two did not. The USCC feed, for Superstate's crypto carry fund, had last been written on 22 January 2026, 225 days before my read, and it returned its old value with no error of any kind. The ACRED contract I read had never been written at all and returned zero. A zero is worse than a wrong value: a stale price mis-sizes a loan, while a zero can liquidate a whole position at once.

Behind the standard interface, the WRITER_ROLE that posts values on three of these contracts, USCC, USYC and ACRED, belonged to a single proxy contract, and the admin roles sat with externally owned accounts, meaning single private keys. Seven of the eight contracts returned maxPriceDeviation = 0, and the code comment says zero disables the check that caps how far a new value may jump. On USCC that call failed, so its setting is unknown.

The ACRED zero has a likely innocent explanation. RedStone publishes its ACRED feed at different addresses on Ethereum and Polygon, so the contract I read was probably an unused one. My read also measured state, not use: I did not establish that any live market prices collateral from these eight addresses.

Four providers, four designs

Four providers carry most RWA data, and each built its network around a different problem.

Chainlink is the incumbent. Its Data Feeds use Off-Chain Reporting: nodes exchange observations off-chain, one node assembles a report, a quorum co-signs it, and one on-chain transaction posts the median. Data Streams is its pull product for low-latency trading. For RWAs it sells SmartData, a family of three feeds: Proof of Reserve, NAVLink for fund NAV, and SmartAUM for assets under management. Securitize adopted NAVLink to price its funds as collateral on Aave Horizon, with VanEck's VBILL among the first assets.

Pyth specializes in fast market prices. More than 120 institutions, including Cboe, Coinbase and Virtu, publish their own prices to Pyth's dedicated chain, Pythnet, which combines them into one price with a confidence interval. The Wormhole bridge relays those prices to other chains, and anyone can post an update when a transaction needs it. Pyth pushes into equities, ETFs and commodities, and it built a USDY feed with Ondo in July 2024. It is not a NAV specialist.

Chronicle is the oracle MakerDAO built in 2017 for DAI's predecessor, spun out as Chronicle Labs and opened to outside projects in September 2023. Its Scribe design aggregates many signatures into one, so adding signers barely raises the gas cost of an update. In RWA it verifies assets rather than trading prices: a Chronicle Proof of Asset feed has covered BUIDL since March 2026, and Superstate chose Chronicle's Verified Asset Oracle for USTB, the fund it launched and still tokenizes, now managed by Invesco.

RedStone is the provider that has gone furthest into fund NAV, and it gets the next section.

RedStone and the single-source problem

RedStone's nodes sign data packages off-chain, and the same signed packages can arrive either way. In the pull model the user attaches them to a transaction. In the push model permissionless relayers post them to an on-chain adapter when a heartbeat or deviation trigger fires. RedStone treats both as first-class, and says it is the only provider to offer both across chains.

Securitize named RedStone its primary oracle partner on 12 March 2025. On 1 July 2025 the two announced TSSO, the Trusted Single Source Oracle, which accepts that a fund has one source and makes that source verifiable instead of pretending to aggregate. Each NAV update carries the asset ID, price, timestamp, a sequence number, and the hash and signature of the previous record, so any gap or edit in the chain of updates shows. A key kept in cold storage signs initial and large changes, and a separate key may post small routine updates within a narrow band.

The second product addresses what happens after the price. Lending markets liquidate in seconds, while redeeming a fund can take 30 to 180 days, in RedStone's own words. RedStone Settle, launched on 28 April 2026, auctions a failing RWA position to KYC-verified solvers. The winner repays the lender in one atomic transaction and then waits for the fund's normal redemption, earning the discount. RedStone has not disclosed any settlement volume.

Proof of reserve answers a narrower question

A NAV says what a unit is worth. A proof of reserve says whether the backing exists at all, and it sits next to two older checks.

An attestation is an accounting firm testing one claim by the issuer, at one moment, and signing a report on it. USDC's reserves are attested monthly. An audit is an opinion on a full set of financial statements over a period, including internal controls. BUIDL's fund is audited annually by PwC. An attestation says nothing about the day before or after, or about whether the assets were pledged elsewhere.

A proof of reserve feed turns that monthly snapshot into a stream: an oracle posts the reserve balance on-chain, and a contract can pause minting if the balance falls short. Chainlink's documentation names the limit. When the list of reserve addresses is self-reported by the issuer, the feed confirms that those addresses hold the funds, but not that the issuer owns them. Checking how a given feed builds its address list belongs in any product analysis.

Where oracle failures come from

Most losses blamed on oracles had nothing to do with the node network. Three documented cases fail at three different points.

In Stream's case, a lending market valued xUSD at 1.06 USD while the market paid about 0.86 USD, because the value came from a hardcoded price or the protocol's own reported NAV instead of a feed. Moonwell's loss came from a misconfigured feed on Base, with no attacker involved.

Tectonic, on the Cronos chain, is the sharpest lesson for RWA collateral. An attacker pumped the TONIC token roughly a hundredfold in 20 minutes on a thin pool, posted it as collateral and borrowed against it. RedStone, whose feed was used, said the oracle reported the pool price accurately, and that reporting a price and judging it safe to lend against are two different jobs. A tokenized fund with a thin secondary market carries the same risk.

The fourth failure mode has no incident yet: a value that ages while nobody attacks anything, like the USCC feed.

What to watch next

• Freshness checks in lending markets: protocols that reject stale NAV by reading updatedAt close the gap measured in this chapter, and their risk parameters show whether they do.
• Pull-model NAV feeds: no provider offers one yet, and one would let a borrower bring a signed, current NAV instead of relying on a stored value.
• Settle volume: the first disclosed settlement numbers will show whether instant liquidation of RWA collateral works outside RedStone's own descriptions.
• Valuation cadence for private credit: disclosure of how often a credit fund is valued, as opposed to published, decides what a daily NAV feed is worth.
• Proof of reserve with verified addresses: feeds that prove ownership of reserve wallets would remove the self-reporting gap Chainlink documents.