An attacker used Ostium's registered PriceUpKeep forwarder and future-dated authorized oracle reports to fabricate profitable trades, draining roughly $18M USDC from its Arbitrum vault. Because the reports arrived through Ostium's authorized price pipeline, the vault accepted fake PnL as valid and paid it out in USDC.

TLDR by @Benthic

Explore the topic

More on $USDC

Comments