“Mango Markets was victim to the latest exploit this week, as crypto cannot seem to escape an absolutely abhorrent Tuesday. Two exploits less than one day apart – and less than a week after the BNB Chain exploit that utilized a bridge to create millions of new BNB. Another nine-figure exploit has rocked the crypto sphere, this time with Solana-based Mango Markets. The protocol faced a massive drain of funds, over $100M worth, after a hacker drained the project through price manipulation and high-dollar leverage” [Mckenna, S. Solana-Based Mango Protocol Suffers $100M+ Exploit. (Accessed October 12, 2022)].
It is early into this exploit, but what follows is what is known at this time about the same.
“The exploit was first identified by blockchain security firm OtterSec which tweeted the exchange had been drained of over $100 million due to the attacker manipulating the value of their Mango (MNGO) native token collateral, then taking out “massive loans” from Mango’s treasury” [Coghlan, J. $100M drained from Solana DeFi platform Mango Markets, token plunges 52%. (Accessed October 12, 2022)].
.png)
In its initial response following OtterSec’s notice of exploit, Mango Market characterized the wrongdoing as ‘oracle price manipulation.’ Additionally, Mango warned “users not to deposit funds until ‘the situation was more clear’ and asked the attacker to contact them to discuss a bug bounty” [Id].
.png)
“The team later confirmed the manipulation of a price oracle — a price data feed of the value of its MNGO token — and stated that it had disabled deposits while it continued investigations of the incident” [Id].
.png)
“Critics have emerged with Discord screenshots from earlier this year that show channel moderators acknowledging concerns about exactly what seemed to have led to Mango’s downfall: massive futures bets against themselves and price manipulation, effectively taking advantage of a low-volume trading token” [Mckenna, supra].
At present (October 12, 2022 @ 05:28 ET) Mango (MNGO) is trading at $0.02368, down 41.17% over the past 24 hours per CoinMarketCap. The one day price chart for MNGO clearly exhibits the price manipulation as well as the resultant effects of this exploit:
.png)
We’re fresh off the heels of a massive, six-figure exploit of Binance Bridge that resulted in newly minted tokens in the range of $500M in value. While not as high-dollar, news of another million dollar vulnerability in Ethereum-based Temple DAO is less than a day old. The combination with now this latest trio in October alone rings another stark reminder how much of a vital issue both smart contract security and risk management are in this space.
[Id].
