Oracle Manipulation attacks in 2022

Lodestar on Arbitrum lost $6.5M after its plvGLP oracle ignored donate() inflating GLP assets, letting the attacker borrow against 83%-inflated collateral.

Lodestar on Arbitrum lost $6.5M after the attacker manipulated the plvGLP oracle, which read GLP pool state directly, to inflate collateral and borrow reserves.

$1.1M drained from Sovryn, a Bitcoin-DeFi protocol on RSK, via AMM/oracle price manipulation that let the attacker borrow against inflated collateral.

$8.4M extracted from Celo's Moola Market: attacker bought MOO with $243K of CELO, pumped it 300x, used as collateral; 93.1% returned for a $500K bounty.

Avraham Eisenberg pumped the MNGO oracle 2,300% in 10 minutes, borrowed $117M against the inflated collateral, and walked — reframing on-chain manipulation law.

A $10M USDC flash loan inflated Nirvana's ANA token 4x against its own oracle; the attacker swapped ANA for $13.49M USDT and the NIRV stablecoin depegged 90%.

Fortress Protocol on BNB Chain lost $3M after the attacker manipulated FTS via a thin oracle and used a governance proposal to set arbitrary collateral factors.

DEUS DAO lost $13.4M after pricing DEI collateral from a Solidly DEI/USDC pool that a flash-loan attacker moved, borrowing out the lending reserves.

$15.6M drained from Inverse Finance by manipulating its Keep3r INV/ETH oracle via a private mempool bundle, bypassing TWAP in a single invisible block.