Oracle and price manipulation

Graduate · enrolled learners

This lesson opens with Cream Finance, 27 October 2021.

What happened

In its third flash-loan exploit of the year, Cream Finance was drained of about 130 million dollars. The attacker flash-borrowed DAI from Maker, used it to mint a large amount of the yUSD share token, then transferred Yearn Curve tokens directly into the yUSD vault. The vault's price per share is assets divided by shares, so a donation of assets with no new shares raised the price per share; Cream priced yUSD from that figure, so its oracle reported yUSD at roughly two dollars instead of one. The attacker then borrowed against the inflated collateral value until the protocol was empty, all inside transactions funded by the flash loan and repaid at the end. Yearn later recovered about 9.4 million dollars the attacker had donated to manipulate the share price.

The decision point

Cream's solvency invariant depended on pricing collateral correctly, and it priced yUSD from a number, the vault's price per share, that the attacker could move within a single transaction by donating assets to the vault. The protocol treated a momentary, manipulable value as if it were the token's real worth. This is the oracle-manipulation class, and it is the largest single category of DeFi loss: not a bug in the pricing code, which worked exactly as written, but a pricing source that could be pushed. A user assessing any lending market, derivatives venue or algorithmic stablecoin is really asking one question here: where does this protocol get its prices, and can I, or a flash loan, move that source before it reads.

Recorded loss

$130,000,000

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.