Hi @Angelo_Canesso
The off chain server is chosen by the company who have develop the oracle.
If an hacker want to do that, he will have to hack the company who provide the data to the oracle company.
Let’s take an example (a fake example), let’s say your Dapp is using Chainlink oracle to get the bitcoin price.
Chainlink will update the bitcoin price in his oracle smart contract, they are usually building an index based on multiples source.
ex: Coinmarketcap / CoinGecko/ Coinparprika
Only the owner of the contract is able to update the oracle contract (Chainlink) and as they have probably some mechanism in place to avoid slippage (if the price is ~5% the same or less i don’t know
)
It will be really complicated for an Hacker to achieve it because he will have to hack multiples company who are providing the price in the same time and avoid Chainlink protection mecanism. (For random number this is the same thing they are using multiples sources)
An other miss conception you can have regarding the oracle is that everybody is able to send a random number to your callback . This is not the case as at the beginning of your callback you are usually checking the oracle address :
require(msg.sender == provable_cbAddress(), "msg.sender is not a Provable_cbAddress");
It has been done in the past during a flashloan attack, an hacker was able to use a flashloan to sell a lot of crypto on an exchange use as index price to exploit an other exchange.
The error here cas to use only one external company as data provider.