Ostium said the attack that drained its OLP vault stemmed from a compromise of permissions in its offchain price reporting system rather than a smart contract bug. In its official report, the protocol said the attacker obtained offchain authorization and then used an already registered and legitimate forwarding route to submit fabricated BTC-USD prices of $5,000 and $60,000. That setup allowed an atomic open-and-close arbitrage loop within the same transaction. Starting with 100 USDC, the attacker scaled the strategy across eight transactions and extracted 23.75 million USDC from the OLP vault in about five minutes before the vault’s circuit breaker was triggered. Ostium said the root issue was that its offchain infrastructure lacked a multi-party approval process comparable to the protections used in onchain multisig systems, leaving a single point of failure in permissions. The stolen funds have since been converted into ETH and passed through Tornado Cash, while tracing efforts are still underway.
According to an official report from Ostium cited by ChainCatcher, the protocol’s latest exploit was caused by a compromise of permissions in its offchain price reporting system, not by a vulnerability in its smart contracts.
Ostium said the attacker gained offchain authorization and used a legitimate forwarding route already registered by the protocol to submit fabricated prices to the BTC-USD market. The false prices were $5,000 and $60,000.
With those submissions, the attacker was able to carry out an atomic arbitrage loop that opened and closed positions within the same transaction.
The report said the attack began with 100 USDC and was scaled up progressively. Over eight transactions, the attacker drained 23.75 million USDC from the OLP vault in five minutes, until the vault’s circuit breaker mechanism was activated.
Ostium said the underlying problem was that its offchain infrastructure did not have a multi-party approval mechanism on par with the protections used in onchain multisig setups, creating a single-point permissions weakness.
The stolen funds have been converted into ETH and routed through Tornado Cash. Tracing efforts are still ongoing.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
