Oracle price deviation >X% from secondary
A real-time signals factor in the v1.7.0 rubric. Measured per protocol on a rt cadence.
Methodology how we score #
What this measures
This real-time signal fires when the price reported by the protocol's primary oracle deviates from the best available secondary source (a redundant feed, a DEX subgraph, or a centralized reference price) by more than a configurable threshold. The deviation threshold is calibrated per asset class — stablecoins have a tighter threshold (default 1%) than volatile assets (default 5%). The signal is generated by continuous comparison of primary oracle output against secondary price references. Category 6 context: oracle price deviation is the most direct real-time indicator of an ongoing oracle manipulation attack.
Why it matters
Oracle manipulation is the third-largest exploit class in the dataset by dollar volume, responsible for over $120M in losses across six protocols. Inverse Finance ($15.6M, 2022) showed a 50x price spike on the oracle immediately visible on-chain — a textbook exploit-in-progress signal. BonqDAO ($120M, 2023) reported WALBT at an astronomical price via its oracle, detectable instantly against any reference. Mango Markets ($115M, 2022) showed MNGO spot pumping 30x. Drift Protocol ($285M, 2026) used an attacker-deployed CVT oracle not sourced from any recognized provider — detectable by cross-referencing against known-canonical feeds. A secondary-reference comparison catches all of these.
Green / Yellow / Red
Green is the baseline when all primary oracle prices are within the calibrated deviation band from secondary sources across all monitored assets. Yellow fires when a deviation exceeds the threshold for one asset but the secondary source itself shows elevated volatility — possible legitimate price movement. Red fires when a primary oracle price deviates from all available secondary references by more than the threshold, particularly if the deviation is accompanied by abnormally large borrowing activity against the asset.
Common gray cases
Gray applies when no reliable secondary price source is available for a specific asset (e.g., a newly launched token with thin liquidity across all venues), or when the protocol's oracle intentionally diverges from spot prices during a TWAP window.
Notable historical examples
- Drift Protocol ($285M, 2026): Attacker-deployed CVT oracle not matching any recognized provider; detectable as non-canonical.
- Cetus Protocol ($223M, 2025): Token prices crashed 75-80% on Sui during exploit; oracle feeds from Cetus pools showed immediate anomaly.
- BonqDAO ($120M, 2023): WALBT oracle price at astronomical value; instantly detectable against any reference.
- Mango Markets ($115M, 2022): MNGO spot price pump 30x; extreme and detectable.
- Harvest Finance ($33.8M, 2020): Curve Y-pool USDC/USDT ratio visibly distorted on every manipulation cycle.
Measurement what to look for #
Detect whether the primary oracle's reported price deviates >X% from the best available secondary source (another feed or venue).
Data & output #
Data source
On-chain primary oracle price read + Chainlink/Pyth/DEX secondary price comparison
Output format
Green / Yellow / Red
Evidence artifact
Primary oracle price + secondary source price + deviation % + timestamp
Confidence signal
green = signal not firing; yellow = deviation 5–10%; red = deviation >10%; gray = secondary oracle reference not configured
Scored protocols 0 carry this factor #
No protocols have been scored for this factor yet.
Linked hacks 61 historical incidents #
illustrative Rhea Finance (merged entity of Ref Finance DEX + Burrow Finance lending; launched February 2025) — Permissionless fake-token pool creation → spot-price oracle acceptance → margin-trading `min_amount_out` double-counting across sequential swaps 2026-04-16 · $18M · Permissionless fake-token pool creation → spot-price oracle acceptance → margin-trading `min_amount_out` double-counting across sequential swaps · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly: Y — price history for fake tokens was entirely self-generated from attacker wash trades; any oracle with a liquidity threshold or token-age ...]
illustrative Silo Finance (V2, soUSDC managed vault on Arbitrum) — Immutable hardcoded wstUSR oracle (pricing depegged asset ~10x reality) + supply-cap bypass via `receiver` parameter + `totalAssets()` summing externally-donated shares 2026-04-03 · $392K · Immutable hardcoded wstUSR oracle (pricing depegged asset ~10x reality) + supply-cap bypass via `receiver` parameter + `totalAssets()` summing externally-donated shares · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly: Y — ~9.4x mispricing (oracle $1.13 vs market $0.12) for ~12 days]
illustrative Drift Protocol (Solana perpetual futures DEX) — Multi-month social engineering + Solana durable-nonce pre-signing + fake-collateral-token / attacker-controlled oracle 2026-04-01 · $285M · Multi-month social engineering + Solana durable-nonce pre-signing + fake-collateral-token / attacker-controlled oracle · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly: Y — attacker-deployed CVT oracle (not a recognized oracle provider); price feed detectably non-canonical]
illustrative YieldBlox / Script3 (Blend V2 community-managed pool) — Illiquid collateral oracle manipulation — single USTRY/USDC trade pumped price 100x → inflated collateral → undercollateralized borrow drain 2026-02-22 · $11M · Illiquid collateral oracle manipulation — single USTRY/USDC trade pumped price 100x → inflated collateral → undercollateralized borrow drain · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly: Y — 100x price spike on USTRY with zero competing volume; Reflector reported $106.74 on a ~$1.06 asset; Oracle Adapter passed it without med...]
illustrative Moonwell — Oracle Misconfiguration (Missing ETH/USD Multiplier) 2026-02-15 · $2M · Oracle Misconfiguration (Missing ETH/USD Multiplier) · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly (Y/N): Y — cbETH price dropped from ~$2,200 to $1.12 immediately on oracle activation]
illustrative Makina Finance — Permissionless share price oracle update (updateTotalAum) + flash loan Curve pool manipulation → share price inflation → LP drain 2026-01-20 · $4M · Permissionless share price oracle update (updateTotalAum) + flash loan Curve pool manipulation → share price inflation → LP drain · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly (Y/N): Y — extreme share price spike during flash loan manipulation would be detectable via oracle monitoring]
illustrative Aevo (formerly Ribbon Finance) — Proxy upgrade removed oracle access control — oracle price settable to arbitrary value → vault fully drained in atomic loop 2025-12-12 · $3M · Proxy upgrade removed oracle access control — oracle price settable to arbitrary value → vault fully drained in atomic loop · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly (Y/N): Y — oracle access control silently removed; price became settable by anyone]
illustrative New Gold Protocol (NGP) — Flash loan + spot price oracle manipulation + broken transfer logic (dead address bypass of buy limits) 2025-09-17 · $2M · Flash loan + spot price oracle manipulation + broken transfer logic (dead address bypass of buy limits) · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly: Y — PancakeSwap pool reserves manipulated to produce false price]
illustrative Odin.Fun — AMM Liquidity Manipulation (Governance Token Price Pump + Drain) 2025-08-12 · $7M · AMM Liquidity Manipulation (Governance Token Price Pump + Drain) · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly (Y/N): Y — AMM price manipulation of SATOSHI token]
illustrative ResupplyFi — ERC4626 Donation Attack (Vault Inflation / Zero Exchange Rate) 2025-06-25 · $10M · ERC4626 Donation Attack (Vault Inflation / Zero Exchange Rate) · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly: Y — oracle reported astronomically inflated price for newly donated vault; any oracle sanity check would have flagged price as unrealistic]
illustrative Cetus Protocol — Integer Overflow / Division-by-Near-Zero in Concentrated Liquidity Math 2025-05-22 · $223M · Integer Overflow / Division-by-Near-Zero in Concentrated Liquidity Math · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly (Y/N + detail): YES** — Token prices crashed 75–80% on Sui during the exploit. Meme coins died first. Price oracle feeds from Cetus pools would have shown i...]
illustrative Loopscale (formerly Bridgesplit) — Oracle Price Manipulation (RateX PT Token Pricing) 2025-04-26 · $6M · Oracle Price Manipulation (RateX PT Token Pricing) · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly (Y/N): Y — PT token reported price vs. RateX market price divergence detectable]
illustrative KiloEx — Missing signature verification in MinimalForwarder → unvalidated oracle price update → multi-chain drain 2025-04-14 · $7M · Missing signature verification in MinimalForwarder → unvalidated oracle price update → multi-chain drain · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly (Y/N): Y — extreme ETH price swings ($100 to $10,000) on-chain during attack; detectable if monitoring oracle price feeds]
illustrative Polter Finance — Spot price oracle manipulation (SpookySwap V2/V3) → inflated BOO collateral → draining borrow 2024-11-16 · $9M · Spot price oracle manipulation (SpookySwap V2/V3) → inflated BOO collateral → draining borrow · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly: Y — BOO spot price in SpookySwap would show extreme anomaly during the drain-and-borrow window]
illustrative Bedrock (uniBTC vault) — Unregistered NATIVE_BTC in SigmaSupplier → disabled supply cap → ETH-to-BTC 1:1 minting (infinite mint) 2024-09-25 · $2M · Unregistered NATIVE_BTC in SigmaSupplier → disabled supply cap → ETH-to-BTC 1:1 minting (infinite mint) · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly (Y/N): Y — uniBTC price crashed on multiple pairs (detectable post-facto)]
illustrative Banana Gun — Telegram Message Oracle Vulnerability 2024-09-19 · $3M · Telegram Message Oracle Vulnerability · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly (Y/N): Y — the Telegram message oracle itself was the attack surface]
illustrative Rho Market — Oracle misconfiguration (deployment error) → MEV bot price manipulation → USDC/USDT drain 2024-07-19 · Oracle misconfiguration (deployment error) → MEV bot price manipulation → USDC/USDT drain · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly: Y — explicit oracle misconfiguration; price feeds returned incorrect values for collateral pricing]
illustrative WooFi (WooPPV2) — Flash loan → WOO oracle price manipulation → pool swap drain 2024-03-05 · $9M · Flash loan → WOO oracle price manipulation → pool swap drain · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly: Y — WOO price was manipulated to extreme levels within the sPMM system; a price deviation monitor against Chainlink would have flagged this ...]
illustrative Gamma Strategies — Flash Loan — LP Token Price Manipulation (Price Threshold Bypass) 2024-01-04 · $5M · Flash Loan — LP Token Price Manipulation (Price Threshold Bypass) · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly: Y — LP token price manipulation via flash loan is detectable as an anomalous price spike within the vault's price feed during the attack]
illustrative Levana Protocol — Oracle Price Delta Manipulation (Timing + Network Congestion) 2023-12-13 · $1M · Oracle Price Delta Manipulation (Timing + Network Congestion) · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly (Y/N): Y — oracle update lag windows exploited; detectable in retrospect]
illustrative KyberSwap Elastic — Tick Manipulation + Double Liquidity Counting — Precision Arithmetic Edge Case 2023-11-22 · $48M · Tick Manipulation + Double Liquidity Counting — Precision Arithmetic Edge Case · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly: Y — pool prices pushed into empty liquidity zones; abnormal swap states]
illustrative dYdX v3 — Market Manipulation (Low-Liquidity Token — YFI Long + Spot Dump) 2023-11-20 · $9M · Market Manipulation (Low-Liquidity Token — YFI Long + Spot Dump) · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly: Y — YFI spot price crashed 40% in a manipulated move; the oracle used for liquidation pricing reflected the manipulated spot price]
illustrative Zunami Protocol — Flash loan + SDT token swap → totalHoldings price calculation manipulation → zETH/UZD LP price manipulation → drain 2023-08-13 · $2M · Flash loan + SDT token swap → totalHoldings price calculation manipulation → zETH/UZD LP price manipulation → drain · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly: Y — zStable LP prices distorted via totalHoldings() manipulation; 85% and 99% depeg visible]
illustrative EraLend (formerly Nexon Finance) — Read-Only Reentrancy (SyncSwap LP Callback — Stale Reserves Oracle) 2023-07-25 · $3M · Read-Only Reentrancy (SyncSwap LP Callback — Stale Reserves Oracle) · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly: Y — LP token price spike during reentrancy window detectable in real time if oracle price is monitored against reference]
illustrative Conic Finance — Read-only reentrancy in CurveLPOracleV2 (ETH/WETH mismatch bypassed reentrancy guard) + sandwich attack on imbalanced pool 2023-07-21 · $4M · Read-only reentrancy in CurveLPOracleV2 (ETH/WETH mismatch bypassed reentrancy guard) + sandwich attack on imbalanced pool · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly (Y/N): Y — rETH Curve LP token price manipulation is detectable as an oracle anomaly]
illustrative Sturdy Finance — Read-only reentrancy on Balancer LP (B-stETH-STABLE) → manipulated collateral price → undercollateralized borrow drain 2023-06-12 · $800K · Read-only reentrancy on Balancer LP (B-stETH-STABLE) → manipulated collateral price → undercollateralized borrow drain · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly: Y — SturdyOracle returned an inflated collateral price during the Balancer callback window; detectable as a price divergence from the true B...]
illustrative dForce Network — Read-Only Reentrancy (Curve wstETH/ETH LP Oracle Manipulation) 2023-02-13 · $4M · Read-Only Reentrancy (Curve wstETH/ETH LP Oracle Manipulation) · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly: Y — virtual price spike during reentrancy window is detectable post-hoc; the `get_virtual_price` manipulation is the core exploitable signal]
illustrative BonqDAO — Oracle Manipulation (Tellor Price Feed — Instant Value) 2023-02-01 · $120M · Oracle Manipulation (Tellor Price Feed — Instant Value) · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly (Y/N): Y — WALBT oracle price reported at an astronomical value; detectable instantly]
illustrative Midas Capital — Read-only reentrancy on Curve LP token virtual price — inflated collateral valuation 2023-01-15 · $660K · Read-only reentrancy on Curve LP token virtual price — inflated collateral valuation · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly: Y — virtual_price() returned inflated value during reentrant window]
illustrative Lodestar Finance — Oracle Price Manipulation (LP Token Donation) 2022-12-10 · $7M · Oracle Price Manipulation (LP Token Donation) · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly (Y/N): Y — GLPOracle price inflation detectable via `donate()` call monitoring]
illustrative Ankr (aBNBc) + Helio Money (HAY stablecoin) — Deployer private key compromise → malicious aBNBc contract upgrade → permissionless infinite mint → PancakeSwap pool drain + Helio collateral collapse 2022-12-02 · $5M · Deployer private key compromise → malicious aBNBc contract upgrade → permissionless infinite mint → PancakeSwap pool drain + Helio collateral collapse · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly (Y/N): Y — aBNBc price crashed; Helio's oracle failed to update fast enough (secondary exploit)]
illustrative Moola Markets — Price Manipulation (Native Token Collateral) 2022-10-19 · $8M · Price Manipulation (Native Token Collateral) · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly (Y/N): Y — MOO price oracle reflected manipulated DEX price]
illustrative Mango Markets — Self-funded MNGO spot price pump using two accounts → inflated unrealized collateral → lending pool drain 2022-10-11 · $115M · Self-funded MNGO spot price pump using two accounts → inflated unrealized collateral → lending pool drain · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly (Y/N): Y — MNGO spot price pump to $0.91 was extreme and detectable]
illustrative Sovryn — External call reentrancy via callTokensToSend — token price inflation via mid-transaction mint → overclaim via burn 2022-10-04 · $1M · External call reentrancy via callTokensToSend — token price inflation via mid-transaction mint → overclaim via burn · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly: Y (internal) — the tokenPrice calculation relied on in-flight state that hadn't been committed; the price diverged from true value mid-trans...]
illustrative Nirvana Finance — Flash Loan + AMM Price Manipulation (Treasury Drain) 2022-07-28 · $4M · Flash Loan + AMM Price Manipulation (Treasury Drain) · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly (Y/N): Y — ANA price manipulation via flash loan]
illustrative Crema Finance — Faulty Account Owner Validation — Fake Tick Account Injection 2022-07-04 · $9M · Faulty Account Owner Validation — Fake Tick Account Injection · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly: Y — tick account data (price data used for fee calculation) was fabricated; a monitoring system comparing tick account owner validity agains...]
illustrative Inverse Finance — Oracle Price Manipulation (Flash Loan) 2022-06-16 · $6M · Oracle Price Manipulation (Flash Loan) · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly (Y/N): Y — massive pool balance distortion detectable on Curve]
illustrative Mirror Protocol (REKT 2) — Missing Duplicate-Call Check (Re-entrancy variant) 2022-05-31 · $92M · Missing Duplicate-Call Check (Re-entrancy variant) · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly (Y/N): Y (Exploit 2 only — LUNA depeg oracle inconsistency)]
illustrative Fortress Protocol (lending arm of JetFuel Finance) — Oracle Manipulation + Malicious Governance Proposal 2022-05-09 · $3M · Oracle Manipulation + Malicious Governance Proposal · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly: Y — publicly callable oracle submit() means any price submission is a potential manipulation; FTS price spike at time of exploit is detectab...]
illustrative Saddle Finance — Flash Loan + LP Token Price Manipulation (Old MetaSwapUtils Library) 2022-05-01 · $11M · Flash Loan + LP Token Price Manipulation (Old MetaSwapUtils Library) · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly: Y — LP token price manipulation detectable as price deviation from VirtualPrice baseline]
illustrative Deus DAO — Dual oracle manipulation — VWAP oracle pre-poisoned via flash swap, then on-chain AMM oracle manipulated via flash loan — to inflate DEI collateral value and borrow far beyond real collateral worth 2022-04-28 · $13M · Dual oracle manipulation — VWAP oracle pre-poisoned via flash swap, then on-chain AMM oracle manipulated via flash loan — to inflate DEI collateral value and borrow far beyond real collateral worth · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly: YES** — the pre-poisoning transaction creates an anomalous USDC/DEI price movement on Solidly; a monitor watching for large sudden DEI price...]
illustrative Elephant Money — Flash loan + spot price manipulation during stablecoin minting 2022-04-12 · $22M · Flash loan + spot price manipulation during stablecoin minting · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly: Y — ELEPHANT price spiked anomalously during minting cycle; spot price used as oracle was directly manipulable]
illustrative Inverse Finance — SushiSwap TWAP Oracle Manipulation — Thin Liquidity Governance Token 2022-04-02 · $16M · SushiSwap TWAP Oracle Manipulation — Thin Liquidity Governance Token · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly: Y — INV price spiked 50x on SushiSwap; visible on-chain immediately]
illustrative Deus DAO (DEI lending contract) — Flash loan oracle manipulation via Solidly AMM pool → user position liquidation 2022-03-15 · $3M · Flash loan oracle manipulation via Solidly AMM pool → user position liquidation · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly (Y/N): Y — oracle price manipulated during the flash loan; detectable as a price spike/crash]
illustrative Deus DAO (1st incident) — Flash loan → spot price manipulation of Solidex USDC/DEI AMM pool (used as oracle) → user positions liquidated 2022-03-15 · $3M · Flash loan → spot price manipulation of Solidex USDC/DEI AMM pool (used as oracle) → user positions liquidated · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly (Y/N): Y — the sAMM-USDC/DEI pool price was severely distorted mid-transaction; detectable as a sharp oracle deviation]
illustrative Meter (Passport Bridge) — Deposit method calldata bypass — unwrapped native token assumption not enforced in secondary deposit path 2022-02-05 · $8M · Deposit method calldata bypass — unwrapped native token assumption not enforced in secondary deposit path · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly: Y (indirect) — Hundred Finance collateral damage enabled because Chainlink oracle price diverged from local manipulated BNB.bsc price on Moo...]
illustrative MonoX — Native token self-swap price inflation — tokenIn/tokenOut identity bypass 2021-11-30 · $31M · Native token self-swap price inflation — tokenIn/tokenOut identity bypass · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly: Y — spot price of MONO within the pool's own price oracle would have appeared to spike anomalously mid-attack]
illustrative Indexed Finance — Flash Loan — Rebalancing Delay Pool Oracle Manipulation 2021-10-14 · $16M · Flash Loan — Rebalancing Delay Pool Oracle Manipulation · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly: Y — pool's internal valuation dropped to ~$300k from $100M+ equivalent; 99.97% distortion]
illustrative Vee Finance — Pangolin spot price oracle manipulation via custom trading pairs + decimal handling bug 2021-09-21 · $34M · Pangolin spot price oracle manipulation via custom trading pairs + decimal handling bug · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly: Y — Pangolin spot prices manipulated via newly created low-liquidity pairs; observable if monitoring oracle price vs reference]
illustrative xToken Market — Public callFunction() in xSNXAdmin — same SNX price manipulation, different access control bug 2021-08-30 · $5M · Public callFunction() in xSNXAdmin — same SNX price manipulation, different access control bug · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly: Y — SNX price crashed during attack sequence visible on DEXes]
illustrative SafeDollar — Infinite Mint via Fee-on-Transfer Reward Accounting Bug 2021-06-28 · $248K · Infinite Mint via Fee-on-Transfer Reward Accounting Bug · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly: Y — SDO price crashed to $0 during the exploit sequence]
illustrative Belt Finance — Flash Loan + Price/Share Manipulation (Incorrect Share Valuation) 2021-05-29 · $6M · Flash Loan + Price/Share Manipulation (Incorrect Share Valuation) · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly (Y/N): Y — price manipulation via Ellipsis swaps distorted share valuations]
illustrative Merlin Labs (REKT 2) — Oracle Mispricing 2021-05-27 · $550K · Oracle Mispricing · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly (Y/N): Y — BAND mispriced by new calculator]
illustrative PancakeBunny — Flash loan + spot price manipulation → inflated LP token valuation → excess BUNNY minting 2021-05-19 · $45M · Flash loan + spot price manipulation → inflated LP token valuation → excess BUNNY minting · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly: Y — WBNB/BUSDT LP token valuation would have shown extreme anomaly during the swap manipulation window]
illustrative xToken Market — Flash loan + SNX/BNT price manipulation → xSNX/xBNT share price inflation → drain 2021-05-12 · $24M · Flash loan + SNX/BNT price manipulation → xSNX/xBNT share price inflation → drain · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly: Y — xSNXa/xBNTa price divergence from manipulated underlying spot prices; Uniswap V2 SNX price cratered during attack]
illustrative BT Finance + Growth DeFi (two separate hacks, one article) — BT Finance: Flash Loan Price Manipulation; Growth DeFi: Fake Token LP Injection 2021-02-09 · $2M · BT Finance: Flash Loan Price Manipulation; Growth DeFi: Fake Token LP Injection · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly: Y (BT Finance — price manipulation is oracle/reserve anomaly)]
illustrative Yearn Finance (yDAI v1 vault) — Flash loan + Curve 3pool spot price manipulation → vault share price arbitrage → DAI drain during migration 2021-02-04 · $11M · Flash loan + Curve 3pool spot price manipulation → vault share price arbitrage → DAI drain during migration · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly: Y — the Curve 3pool composition was severely distorted during the attack, which would appear as extreme price deviation on any in-block orac...]
illustrative Warp Finance — Flash loan + Uniswap V2 LP token spot oracle manipulation → inflated collateral → over-borrow drain 2020-12-17 · $8M · Flash loan + Uniswap V2 LP token spot oracle manipulation → inflated collateral → over-borrow drain · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly: Y — Uniswap V2 WETH-DAI LP spot price doubled mid-transaction; observable if monitoring oracle price deviation]
illustrative Value DeFi — Flash loan + Curve spot price oracle manipulation → inflated collateral → over-borrow drain 2020-11-14 · $7M · Flash loan + Curve spot price oracle manipulation → inflated collateral → over-borrow drain · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly: Y — Curve spot price doubled during attack; observable if monitored]
illustrative Cheese Bank — Flash loan + Uniswap LP spot oracle manipulation → inflated collateral value → drain via borrow() 2020-11-06 · $3M · Flash loan + Uniswap LP spot oracle manipulation → inflated collateral value → drain via borrow() · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly: Y — Uniswap CHEESE/ETH pool WETH balance spiked from normal to 20,000+ ETH within a single transaction, just before oracle refresh and borro...]
illustrative Harvest Finance — Flash loan + Curve Y-pool spot price manipulation → inflated fToken share valuation → vault drain 2020-10-26 · $34M · Flash loan + Curve Y-pool spot price manipulation → inflated fToken share valuation → vault drain · Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly: Y — Curve Y-pool USDC/USDT ratio was visibly distorted on every exploit cycle]
rubric_version v1.7.0 factor RD-F-099 category 6 carried 0 critical no