Attacker drains $18M USDC from Ostium's vault using future-dated oracle reports and registered PriceUpKeep forwarder

An attacker used Ostium's registered PriceUpKeep forwarder and future-dated authorized oracle reports to fabricate profitable trades, draining roughly $18M USDC from its Arbitrum vault. Because the reports arrived through Ostium's authorized price pipeline, the vault accepted fake PnL as valid and paid it out in USDC.

TLDR by @Benthic

Explore the topic

• USDC
• Vaults
• Oracle