Пост
Этот пост по его id.
https://api.web3aggregator.io/api/v1/posts/20010 curl -H "Authorization: Bearer $W3A_API_KEY" 'https://api.web3aggregator.io/api/v1/posts/20010'Нужен ключ: W3A_API_KEY в окружении.
API отдаёт одно это сообщение: остальные части альбома там — отдельные посты, связанные полем album.
Документация APIBNIX / OSK (CoreVault) hacked for ~$181K
Rootcause: The vault’s BNB principal redemption logic depended on a manipulable on-chain spot price that could be distorted within a single transaction via flash loan.
Key technical failure
The
When the TWAP / average-price windows were empty or unfilled, the median degraded to the live PancakeSwap WBNB/USDT spot price.
That spot price sits in a low-liquidity pair that is trivial to move with a large flash-loan dump.
Attack flow (simplified)
Attacker flash-borrowed ~207k WBNB.
Dumped ~195k WBNB into the PancakeSwap WBNB/USDT pool → artificially inflated
Called
The vault over-paid BNB from the insurance/reserve pool (~260 BNB / ~$181k).
Attacker swapped the excess BNB back, repaid the flash loan, and kept the profit (~160 BNB / ~$112k).
Core design flaw
The protocol treated a same-block, flash-loan-manipulable spot price as a reliable accounting oracle for redemptions. Proper protections (strict TWAP requirement, secondary oracle fallback that cannot degrade to spot, or circuit breakers on large price deviations) were missing or ineffective.
@EthSecurity1
Rootcause: The vault’s BNB principal redemption logic depended on a manipulable on-chain spot price that could be distorted within a single transaction via flash loan.
Key technical failure
redeemPrincipal() calculated the BNB amount to pay out as:bnbAmount = redeemableUsd × wbnbPerUsd / 1e18The
wbnbPerUsd price came from OracleLib.getAccountingPrices, which used a 3-source median.When the TWAP / average-price windows were empty or unfilled, the median degraded to the live PancakeSwap WBNB/USDT spot price.
That spot price sits in a low-liquidity pair that is trivial to move with a large flash-loan dump.
Attack flow (simplified)
Attacker flash-borrowed ~207k WBNB.
Dumped ~195k WBNB into the PancakeSwap WBNB/USDT pool → artificially inflated
wbnbPerUsd.Called
redeemPrincipal() while the manipulated price was live.The vault over-paid BNB from the insurance/reserve pool (~260 BNB / ~$181k).
Attacker swapped the excess BNB back, repaid the flash loan, and kept the profit (~160 BNB / ~$112k).
Core design flaw
The protocol treated a same-block, flash-loan-manipulable spot price as a reliable accounting oracle for redemptions. Proper protections (strict TWAP requirement, secondary oracle fallback that cannot degrade to spot, or circuit breakers on large price deviations) were missing or ineffective.
@EthSecurity1