Ostium suffers $18 million exploit as oracle attack wave continues to hit DeFi
The decentralized exchange Ostium suffered an $18 million exploit after an attacker manipulated oracle price reports. This incident is part of a broader trend of oracle and keeper-system vulnerabilities currently impacting the DeFi sector.
Why it matters
The exploit underscores the persistent security risks in decentralized finance protocols and the potential for massive financial loss due to infrastructure vulnerabilities.
According to Blockaid's alert, the attacker leveraged a registered PriceUpKeep forwarder, a component of Ostium's automated infrastructure, to submit oracle price reports with future-dated timestamps. The manipulated reports created the appearance of profitable trades, which triggered an $18 million USDC payout from the vault.
Ostium is a decentralized perpetuals exchange on Arbitrum that allows users to trade real-world assets including commodities, forex, and equity indices, with up to 200x leverage, settling in USDC.
Ostium uses a custom price-feed system to track real-world asset prices, with a third-party automation network called Gelato responsible for pushing those prices onchain at the right moments. A smart contract called PriceUpKeep sits at the center of that process, acting as the trigger that writes the latest price data to the blockchain whenever a trade needs to be executed.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in