Rho Market: Oracle misconfiguration (deployment error) → MEV bot price manipulation → USDC/USDT drain

Summary #

Rho Market suffered a Lending / Money Market (Compound Finance fork) on 2024-07-19, resulting in a loss of approximately —.

What happened #

A misconfigured oracle at Rho Market's Scroll-based lending protocol enabled an MEV bot to drain $7.5M — then the bot voluntarily returned everything after demanding Rho publicly admit the error.

Linked factors #

• RD-F-006 — causal : Audit-deploy gap (RD-F-006 time between audit and deploy) [via dashboard_risk_factors/Exploited code newly deployed/upgraded?: Y — newly deployed oracle configuration contained the error] || Audit-deploy gap — alternate field name [via dashboard_risk_factors/Exploited code newly deployed/upgraded?: Y — newly deployed oracle configuration contained the error]
• RD-F-007 — related : Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
• RD-F-027 — causal : ★ Single admin EOA — when value mentions key compromise [via realtime_signals/Governance/admin action: Y — admin deployment of a misconfigured oracle was the root cause]
• RD-F-099 — illustrative : Oracle price deviation > X% from secondary source — RT signal would have fired [via realtime_signals/Oracle anomaly: Y — explicit oracle misconfiguration; price feeds returned incorrect values for collateral pricing]
• RD-F-101 — illustrative : Large governance proposal queued — RT signal would have fired [via realtime_signals/Governance/admin action: Y — admin deployment of a misconfigured oracle was the root cause]
• RD-F-111 — causal : Team doxx status — pseudonymous-no-track-record class [via dashboard_risk_factors/Team anonymity: Unknown]
• RD-F-126 — causal : Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Y — Compound Finance fork]
• RD-F-127 — related : Upstream Compound has patches that may not be merged here [via dashboard_risk_factors/Forked?: Y — Compound Finance fork]
• RD-F-146 — related : New deploys in last 30 days — fresh attack surface [via dashboard_risk_factors/Exploited code newly deployed/upgraded?: Y — newly deployed oracle configuration contained the error]