Oracle and price manipulation

Graduate · enrolled learners

This lesson opens with Cream Finance, 27 October 2021.

What happened

In its third major exploit of 2021, after the Iron Bank in February and an AMP flash-loan attack in August, Cream Finance was drained of about 130 million dollars. The attacker flash-borrowed 500 million DAI from Maker, used it to mint a large amount of the yUSD share token, then transferred Yearn Curve tokens directly into the yUSD vault. The vault's price per share is assets divided by shares, so a donation of assets with no new shares raised the price per share; Cream priced yUSD from that figure, so its oracle reported yUSD at roughly two dollars instead of one. The attacker then borrowed against the inflated collateral value until the protocol was empty, all inside transactions funded by the flash loan and repaid at the end. SlowMist traced the key step to a direct transfer of about 8.43 million of the Yearn Curve pool tokens back into the yUSD vault, which raised the price per share without minting any new shares.

The decision point

Cream's solvency invariant depended on pricing collateral correctly, and it priced yUSD from a number, the vault's price per share, that the attacker could move within a single transaction by donating assets to the vault. The protocol treated a momentary, manipulable value as if it were the token's real worth. This is the oracle-manipulation class, which Chainalysis estimates cost DeFi protocols 403.2 million dollars across 41 attacks in 2022 alone: not a bug in the pricing code, which worked exactly as written, but a pricing source that could be pushed. A user assessing any lending market, derivatives venue or algorithmic stablecoin is really asking one question here: where does this protocol get its prices, and can I, or a flash loan, move that source before it reads.

Recorded loss

$130,000,000

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.