Solana-based DeFi Trading Platform Mango Markets faces a $100M hack

The Solana-based spot margin and perpetual futures crypto trading platform Mango Markets lost $100 million owing to an attack in the second $100 million decentralized finance (DeFi) breach this week. Mango Markets reported on Twitter on Tuesday night that a hacker had used an oracle price manipulation to steal funds from the platform’s treasury.

We will be disabling deposits on the front end as a precaution, and will keep you updated as the situation evolves.

If you have any information, please contact blockworks@protonmail.com to discuss a bounty for the return of funds. 2/

— Mango (@mangomarkets) October 11, 2022

Mango Markets acknowledges the flaw

Notably, the attacker started by temporarily increasing the value of their collateral, according to the blockchain auditing website OtterSec, and then drew out loans from the Mango treasury. The founder of the auditing company Robert Chen told Decrypt that the attack was primarily caused by “an economic design flaw,” and that Mango Markets has already acknowledged it.

Joshua Lim, the head of Derivatives at Genesis Global Trading, commented on the recent attack on Mango DAO-governed platform and stated:

“At 6:19 PM ET, an attacker funded account A with 5mm USDC collateral.”

The attacker then offered 483 million units of MNGO perps (perpetual contracts) on the Mango Markets order book, as Lim said. After this, they  financed another account at 6:24 PM ET with 5 million USDC in collateral to purchase those 483 million MNGO perps at $0.03 each.

The attacker began manipulating the Mango spot market price at 6:26 PM ET, pushing the price to $0.91 and the 483 million MNGO’s worth to $423 million.

A loan of $116 million was then obtained by the assailant, leaving Mango’s treasury with a net loss of $116.7 million. USDC, MSOL, SOL, BTC, USDT, SRM, and MNGO were among the assets drained, completely destroying Mango’s liquidity.

Just last Thursday, the Binance Smart Chain or BNB had $100 million stolen from it, as TheCoinRise reported. Moreover, quantum-resistant layer 1 blockchain QANplatform also faced a Bridge hack that drained $1 million from the platform, plummeting QANX token by 90%.