The strongest "resentment" in history? Mango encounters hacker "stolen" "DAO" double-click

https://www.jinse.com/blockchain/2461344.html

On October 12th, Mango was attacked by hackers, and Mango lost a total of about 116 million US dollars in this attack. In addition, Mango also suffered from alternative attacks by hackers, and Mango was attacked through proposals.

For the convenience of everyone to watch, Jinse Finance has sorted out the hackers' attack methods and event details. For details, please see below.

1. According to the analysis of CertiK Skynet, the attack method is as follows

1. First, the attacker injected $5 million into the first account (CQvKSNnY...) and shorted 483 million units of MNGOperps.
2. The attacker then injected funds into the second account (4ND8FVPjU...) and went long 483 million units of MNGOperps at a price of $0.0382 per unit.
3. The attacker manipulates the price of MNGO on the price oracle (the market price in Mango Market) to increase the price of MNGO, thereby making a profit on the second account.
4. The attacker then used the second account to borrow other tokens on Mango. Then transfer all the liquidity funds on Mango out. Mango's losses totaled about $116 million.

2. Mango was double-clicked by hackers "stolen" and "DAO"

After stealing assets, hackers launched a proposal on Mango: use $70 million from the treasury to pay off bad debts.

After the proposal is passed, the hacker will return about $40 million worth of tokens.

Hackers use the stolen governance tokens to vote on the proposal and choose "agree".

Remarks: At present, the number of voting participants has exceeded 30 million, and the proposal can only be passed if the number of approval votes exceeds 100 million

3. Impact of the event

1. The official statement of UXDProtocol, the Solana ecological stability agreement: UXDProtocol’s total funds affected by the Mango attack incident are 19,986,134.9037 US dollars.

2. Affected by this event, SolanaTVL (TotalValueLocked) fell to $1.04 billion at 11:00 on the same day, a 24-hour drop of 19.9%.

3. Revenue aggregator TulipProtocol stated that the funds affected by the Mango incident are about 2.5 million US dollars

4. Timeline of Mango being stolen

October 12 at 7:00

OtterSec tweeted: Mango, a decentralized financial platform based on Solana, suffered a potential $100 million attack. OtterSec said that the attackers were able to manipulate their Mango collateral. They temporarily increased the value of the collateral and then obtained it from the Mango treasury. Lots of loans.

October 12 at 7:36

In response to a potential $100 million attack, Mango stated that it is investigating an incident in which hackers withdraw funds from Mango through price manipulation of oracle machines, and is currently taking measures to allow third parties to freeze liquidity. As a precaution, Mango will be disabling deposits on the front end and will provide updates as the situation develops, saying they can email to discuss bounties with funds returned.

October 12 at 8:20

UXDProtocol stated: "Our insurance fund is sufficient to cover losses. UXD is fully secured and once MangoMarkets recovers from the exploit, users will be able to redeem it. The total insurance fund is $53,527,304.7757. UXDProtocol has suspended UXD minting to minimize risk change.

October 12 at 9:00

In the Mango attack incident, the hacker initiated a proposal, hoping to use about 70 million USDC in the Mango treasury to repay bad debts. If the proposal is passed, the hacker will transfer the MSOL, SOL and MNGO in the account to the address issued by the Mango team.

The hacker also stated: "All remaining bad debts in the agreement will be repaid by the Mango treasury, and users with no bad debts will not be affected. Any bad debts will be treated as bug bounty/insurance and paid by the Mango insurance fund. If MangoToken holders pass Voting on this proposal means agreeing to pay the bonus and use the treasury to repay bad debts, and to waive any potential claims for bad debt accounts. Once the Token is repaid according to the above rules, there will be no criminal investigation or asset freezing.” The proposal Voting will close in 3 days.

October 12 at 12:30

The DeFi platform Mango on Solana released a detailed report on the attack incident.

The following events occurred in the agreement at about 6:00 on October 12, Beijing time: 2 accounts funded by USDC held excessive positions in MNGO-ERP, and the MNGO/USD bottom layer of each exchange (FTX, Ascendex) The price saw a 5-10x price increase within minutes, causing Switchboard and the Pyth oracle to update their MNGO benchmark price above $0.15.

Further resulting in unrealized profits, the account value of long MNGO-ERP increases according to the market price, allowing the account to borrow and withdraw BTC (sollet), USDT, SOL, mSOL, and USDC from the Mango agreement, making the equivalent value of 190 million US dollars on the platform Deposits were borrowed to their maximum, when the account was withdrawn with a net worth of approximately $100 million.

At 10:37 on October 12, the Mango program instructions were frozen to prevent any further user interaction with the protocol. MangoDAO's priorities are: preventing any further unnecessary losses, securing Mango Protocol's depositor funds, and attempting to salvage some of MangoDAO's value.

Mango believes the most constructive way to resolve this issue is to continue communicating with those responsible for the incident and controlling the funds removed from the protocol to try and resolve the issue amicably.

The above information data comes from CertiK Skynet.