Attacker drains $18M USDC from Ostium's vault using future-dated oracle reports and registered PriceUpKeep forwarder

𝕏/@blockaid_ •

Revision history

2 recorded changes

Want your article here?

An attacker used Ostium's registered PriceUpKeep forwarder and future-dated authorized oracle reports to fabricate profitable trades, draining roughly $18M USDC from its Arbitrum vault. Because the reports arrived through Ostium's authorized price pipeline, the vault accepted fake PnL as valid and paid it out in USDC.

TLDR by @Benthic

Attacker drains $18M USDC from Ostium's vault using future-dated oracle reports and registered PriceUpKeep forwarder

Explore the topic

More on Vaults

Zama opens 16 confidential Morpho vaults on Ethereum after its first vault hit $40M TVL in seven weeks, with five major curators involved

Pear Protocol launches Agent Pear Vault, an automated market-neutral pair-trading strategy capped at $1M

Aave Vaults go live on Turnkey Earn, letting platforms offer users simple DeFi yield access while earning a share of the revenue generated

UAE adopts Avalanche for national digital identity infrastructure, with UAE PASS Digital Vault serving 12M+ people through verified documents

Kraken launches xStocks Vaults with Kamino, Veda and Sentora, letting users earn yield directly in SPYx, QQQx and NVDAx

Aave opens hiring for four engineering roles across Rust, vaults, and payments teams

Zama opens 16 confidential Morpho vaults on Ethereum after its first vault hit $40M TVL in seven weeks, with five major curators involved

Pear Protocol launches Agent Pear Vault, an automated market-neutral pair-trading strategy capped at $1M

Aave Vaults go live on Turnkey Earn, letting platforms offer users simple DeFi yield access while earning a share of the revenue generated

UAE adopts Avalanche for national digital identity infrastructure, with UAE PASS Digital Vault serving 12M+ people through verified documents

Kraken launches xStocks Vaults with Kamino, Veda and Sentora, letting users earn yield directly in SPYx, QQQx and NVDAx

Aave opens hiring for four engineering roles across Rust, vaults, and payments teams

Total stats

How to Earn

Attacker drains $18M USDC from Ostium's vault using future-dated oracle reports and registered PriceUpKeep forwarder

Explore the topic

More on Vaults

Zama opens 16 confidential Morpho vaults on Ethereum after its first vault hit $40M TVL in seven weeks, with five major curators involved

Pear Protocol launches Agent Pear Vault, an automated market-neutral pair-trading strategy capped at $1M

Aave Vaults go live on Turnkey Earn, letting platforms offer users simple DeFi yield access while earning a share of the revenue generated

UAE adopts Avalanche for national digital identity infrastructure, with UAE PASS Digital Vault serving 12M+ people through verified documents

Kraken launches xStocks Vaults with Kamino, Veda and Sentora, letting users earn yield directly in SPYx, QQQx and NVDAx

Aave opens hiring for four engineering roles across Rust, vaults, and payments teams

Zama opens 16 confidential Morpho vaults on Ethereum after its first vault hit $40M TVL in seven weeks, with five major curators involved

Pear Protocol launches Agent Pear Vault, an automated market-neutral pair-trading strategy capped at $1M

Aave Vaults go live on Turnkey Earn, letting platforms offer users simple DeFi yield access while earning a share of the revenue generated

UAE adopts Avalanche for national digital identity infrastructure, with UAE PASS Digital Vault serving 12M+ people through verified documents

Kraken launches xStocks Vaults with Kamino, Veda and Sentora, letting users earn yield directly in SPYx, QQQx and NVDAx

Aave opens hiring for four engineering roles across Rust, vaults, and payments teams

Comments

Total stats

How to Earn