Ostium loses $18M to its own oracle
Ostium is a perp DEX on Arbitrum, offering real-world assets, up to 200x leverage on S&P futures, and gold. It has over $50 billion in volume, raised $27.8 million from investors like General Catalyst, Jump Crypto, Coinbase Ventures, Wintermute, and GSR, and has multiple audits.
On July 15, an attacker drained roughly $18 million in USDC from its liquidity vault. That's around 28% of the vault's $63 million TVL, gone in one session.
The attacker compromised an Oracle signer private key, used a registered PriceUpKeep forwarder for future-dated price reports, and executed about 20 tied trades via delegated actions, creating artificial profits and cashing them out without market exposure or risk.
Ostium is a perp DEX on Arbitrum, offering real-world assets, up to 200x leverage on S&P futures, and gold. It has over $50 billion in volume, raised $27.8 million from investors like General Catalyst, Jump Crypto, Coinbase Ventures, Wintermute, and GSR, and has multiple audits.
On July 15, an attacker drained roughly $18 million in USDC from its liquidity vault. That's around 28% of the vault's $63 million TVL, gone in one session.
The attacker compromised an Oracle signer private key, used a registered PriceUpKeep forwarder for future-dated price reports, and executed about 20 tied trades via delegated actions, creating artificial profits and cashing them out without market exposure or risk.