You'd be surprised the number of people spending majority of their days doing things that make them miserable, simply because others see it as impressive.
Horrible to see the Ostium exploit, bad for everyone in the industry and really sucks. The protocol lost approximately $23.7 million from its OLP vault on Arbitrum across several txns.
Traders on Ostium trade against a liquidity vault that acts as counterparty to every position, so trader profit is paid out of it. The hack essentially let fake/fabricated profitable trades via oracle exploit get paid out in USDC from the vault:
- open a BTC/USD position with USDC margin
- fulfill the open order at $5K/BTC using a fabricated self-signed low opening price
- close the position
- fulfill the close order at $60K/BTC using a fabricated self-signed high price
Inside the first batch call of trades alone, five cycles of this paid out $10K, $90K, $800K, $7M, and $5.3M for a total of $11.86M
2nd attack: $4.5M
3rd: $3.6M
4th: $2.7M
5th: $1M
Ostium uses a signed oracle. The verifier takes a price report, recovers the signer from the signature, and checks that the signer is on an authorized list. It validates the signer's identity, not whether the price is accurate. The attacker held an authorized oracle-signer key and a registered keeper (PriceUpKeep) forwarder, which is the role that fulfills pending orders. Both of these roles should only be granted by Ostium governance/timelock and cannot be self-assigned.
This was a key compromise, not a market-based oracle manipulation (no flash loan, no manipulation of a spot price on a thin pool. Whether the key was stolen externally or misused by someone with access is not yet confirmed.
The attacker has since swapped into ETH and is distributing out large amounts to various wallets. The vault currently holds approximately $9.0M, down 72.5% from $32.7M immediately before the attack.
I said this about AI well over a year ago. Using it to diagnose and fire people with medical conditions so they lose their insurance AND their income is somehow even more heartless and evil than I’d predicted.