Moderate risk — strong institutional backing and growing adoption as the dominant oracle for Solana and newer chains, with manageable risk from Wormhole dependency and the still-maturing first-party oracle model.
Risk Breakdown
Top Risks
First-party oracle data publisher trust: Pyth relies on data publishers (exchanges, market makers, trading firms) to submit honest price data. While aggregation across 124+ publishers reduces manipulation risk, individual publishers could submit stale or incorrect data. The confidence interval mechanism provides a measure of data agreement, but downstream DeFi protocols may not always properly handle wide confidence bands.
Pull-based oracle model introduces latency risk: Unlike Chainlink's push-based model, Pyth uses a pull-based system where consumers must request price updates. If a DeFi protocol fails to pull an update during rapid price movement, it may use stale data for critical operations like liquidations. The 400ms update frequency mitigates this for active consumers, but the model shifts responsibility for freshness to integrators.
Cross-chain message relay dependency: Pyth uses Wormhole as its cross-chain messaging layer to deliver price data from Pythnet (its Solana-based appchain) to 100+ supported blockchains. Wormhole has experienced significant security incidents (including a $320M exploit in February 2022), and any Wormhole vulnerability could compromise price data integrity across all Pyth-integrated chains.
Concentrated publisher ecosystem despite breadth: While Pyth lists 124+ publishers, a significant portion of price feed data comes from a smaller subset of high-volume publishers (Binance, Cboe, Jane Street). If several major publishers simultaneously experience outages or submit incorrect data, the aggregation mechanism may not fully compensate.
Frequently Asked Questions
Is Pyth Network safe to use?
What are the main risks of using Pyth Network?
What is Pyth Network's risk score breakdown?
How does Pyth Network compare to other DeFi protocols?
Has Pyth Network ever been hacked or exploited?
Get risk alerts before it's too late
Weekly grade changes, downgrade alerts, and new protocol risk findings. Free.