Sebastian Sinclair

Macauley Peterson

<div id="highlights-block_634655ddb3f28" class="highlights">
 <ul>
 <li>Mango is currently investigating an exploit of the oracle price feeds for its own governance token</li>
 <li>The hacker responsible is asking DAO members to vote on a proposal that would return a portion of the stolen funds</li>
 </ul>
 
</div>



Mango Markets, a decentralized finance trading platform on the Solana blockchain, said Tuesday it was investigating a hack worth approximately $112 million in digital assets.



Mango said the hacker was able to drain funds from its platform utilizing a technique known as oracle price manipulation — a form of economic attack that has hit other DeFi protocols before.



The actor managed to withdraw various digital assets — mostly stablecoins, including $53.7 million in USD Coin (USDC) and $3.2 million in tether (USDT) — but also solana (SOL).



In an unusual twist, they’re <a href="https://app.realms.today/dao/DPiH3H3c7t47BMxqTxLsuPQpEC6Kne8GA9VXbxpnZxFE/proposal/3WZ5DpZXDvNAK4JwPS1HDPzSinEJUGpBC4XXx9vPtnVS" target="_blank" rel="noreferrer noopener">proposing to return</a> a portion of the stolen funds, namely Marinade-staked solana (MSOL), native SOL and the platform’s own MNGO governance token. The rest the culprit claims as a “bounty.”



That is, of course, if Mango’s DAO community votes yes on the thief&#8217;s proposal.



<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">“By voting for this proposal, mango token holders agree to pay this bounty and pay off the bad debt with the treasury, and waive any potential claims against accounts with bad debt, and will not pursue any criminal investigations or freezing of funds once the tokens are sent back as described above,” <a href="https://app.realms.today/dao/DPiH3H3c7t47BMxqTxLsuPQpEC6Kne8GA9VXbxpnZxFE/proposal/3WZ5DpZXDvNAK4JwPS1HDPzSinEJUGpBC4XXx9vPtnVS" target="_blank" rel="noreferrer noopener">the attacker wrote</a> on the protocol’s governance forum.</blockquote>



The hacker is requesting Mango use its treasury stash of 70 million USDC to repay “bad debt.” This debt derives from an <a href="https://cms.blockworks.co/solana-lending-protocol-faces-governance-conundrum/" target="_blank" rel="noreferrer noopener">incident</a> in June when the Mango community <a href="https://twitter.com/dadadadaffy/status/1539219965492047874" target="_blank" rel="noreferrer noopener">teamed up</a> with another Solana-based lending and borrowing protocol, Solend, to deal with a systemic risk caused by a single large borrower, at risk of liquidation, that put the entire Solana DeFi ecosystem in jeopardy.



The Mango DAO, or stewards of the protocol, should also not pursue any criminal investigations or freeze the attacker’s funds — via centralized stablecoins such as USDC and USDT — once the cryptoassets are returned.



But not all the assets will be returned; while a definitive amount for the bounty was not given, it can be assumed from the tokens omitted from the initial hack that the attacker is requesting to keep well over half of what they stole — substantially more than most “white hat” hackers or <a href="https://cms.blockworks.co/?s=bounty" target="_blank" rel="noreferrer noopener">bug bounty hunters</a> typically receive.



Still, Mango DAO members have so far voted in favor of the hacker’s proposal, with a 99.9% &#8220;yes&#8221; rate from roughly 33 million MNGO tokens — although just a single wallet address is responsible for the lion’s share of the vote. As DAOs go, this one is extremely centralized, with most governance votes being decided by just a handful of addresses.


<div class="wp-block-image">
<figure class="aligncenter is-resized"><img loading="lazy" decoding="async" src="https://lh4.googleusercontent.com/trU04t8jB7XWOD5WPANIn0V_WPQT9lauwb9qncu5j5DiqXFcACTG5GnxwVX3aFRxjwWcmRqTw-RJNNqsciFHU-Ycmi9pB30ehCiUrNjW1T8QOx2lWDsJ2FpZsuV601NVd5CGhPTavLBePiORAbewOcsAbqK2anQML0oV2M7H27yoxDpbwXPjOwkf3Q" alt="" width="800" height="276"/><figcaption>The top voters holding the bulk of MNGO tokens | Source: <a href="https://app.realms.today/dao/DPiH3H3c7t47BMxqTxLsuPQpEC6Kne8GA9VXbxpnZxFE/proposal/3WZ5DpZXDvNAK4JwPS1HDPzSinEJUGpBC4XXx9vPtnVS/explore" target="_blank" rel="noreferrer noopener">Mango governance vote</a></figcaption></figure></div>


A further 67 million yes votes are required for the proposal to pass a quorum threshold during the three-day voting period.



<h3 class="wp-block-heading">Price oracle manipulation</h3>



While the consultation and investigation continue, the platform’s stewards have requested users to cease depositing assets until the situation becomes clearer.



Dapps such as Mango rely on oracles to pull on-chain data for specific tokens. Manipulation occurs when protocols such as data feeds are corrupted, allowing transactions that were not intended.



In the case of Mango, the attacker was able to manipulate their collateral value via the platform before taking out “massive loans” totaling $112,199,876 from Mango’s treasury, security auditing firm <a href="https://twitter.com/osec_io/status/1579969927020412929" target="_blank" rel="noreferrer noopener">OtterSec reported</a> on Twitter.



OtterSec founder Robert Chen confirmed the figure to Blockworks who said the price manipulation was suspected to have occurred on centralized exchanges which Mango used to reference the value of the collateral.



MNGO’s price briefly spiked about 300% to $0.15 in the space of 10 minutes on the FTX exchange, then dropped 88% to under $0.02 following the attack.


<div class="wp-block-image">
<figure class="aligncenter is-resized"><img loading="lazy" decoding="async" src="https://lh3.googleusercontent.com/Ex0Qf7G_cCBVpkcvRInuxhu6D3qAr4Ujh6pQ5uwR_z0s6DxDKHHtistpPfC_lSxNUiHbLG26TMBk51UqyxFtY-glvT72k50Y4emXTJeVPLovBlZN5HHwiBkaWtMjmiHZJpi_SxABEv5w_bQ9b8Sb3L5q2u1yChE0dwG2926O21huIBRc2IJCzQ2mfg" alt="" width="800" height="500"/><figcaption>The MNGO/USD market on FTX, 1-minute time frame | Source: TradingView</figcaption></figure></div>


Solana developer Tom Geshury was credited with being the first to bring the hack to the security auditing firm’s attention.



Geshury told Blockworks the hacker used $10 million to self-trade Mango perpetual contracts and then an estimated $3 million to pump the price of MNGO and execute the plan, before market participants got wind of the scheme and began dumping their tokens.



Mango Markets is <a href="https://docs.mango.markets/tutorials/trading-on-mango" target="_blank" rel="noreferrer noopener">an interface to margin trade</a> on the Serum DEX, which is backed by the crypto arm of trading giant Jump Capital. Jump Crypto’s president Kanav Kariya also confirmed the mechanism at play in the exploit.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">Jesus, the attacker pumped and dumped the mango token, which is a thinly traded token. Oracles just report the price. Pyth/Switchboard accurately reported the prevailing prices on exchanges&mdash; Kanav Kariya (@KanavKariya) <a href="https://twitter.com/KanavKariya/status/1579986625060573184?ref_src=twsrc%5Etfw">October 12, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



Mango has released a <a href="https://twitter.com/mangomarkets/status/1579979342423396352?s=20&amp;t=UHiIdt-zGgX-qsdd8kfG6w" target="_blank" rel="noreferrer noopener">statement</a> saying it is taking steps to have third parties freeze funds in flight.



<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">“We will be disabling deposits on the front end as a precaution and will keep you updated as the situation evolves,” the group <a href="https://twitter.com/mangomarkets/status/1579979342423396352" target="_blank" rel="noreferrer noopener">said via Twitter</a>.</blockquote>



Blockworks attempted to contact several admins on the Mango Discord channel but was unsuccessful.



A number of protocols have been hit by such attacks this year alone, including DeFi platform Inverse Finance for <a href="https://halborn.com/explained-the-inverse-finance-hack-june-2022/" target="_blank" rel="noreferrer noopener">$5.8 million</a> in June and stablecoin lending platform Fortress Protocol for <a href="https://www.stealthlabs.com/news/fortress-protocol-lost-usd-3-mn-in-oracle-price-manipulation-attack/" target="_blank" rel="noreferrer noopener">$3 million</a> in May.



The attack against Mango comes less than a week after Binance’s own network, BNB Chain, was targeted for <a href="https://cms.blockworks.co/binance-pauses-trading-of-native-token/" target="_blank" rel="noreferrer noopener">hundreds of millions of dollars</a> via a cross-chain bridge exploit. The amount stolen was <a href="https://www.bnbchain.org/en/blog/bnb-chain-a-decentralized-response/" target="_blank" rel="noreferrer noopener">contained to about $100 million</a>.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>
</ul>

exploit

Mango Markets Mangled by Oracle Manipulation for $112M

Shalini Nagarajan

<div id="highlights-block_633fdbb08b4d2" class="highlights">
 <ul>
 <li>Yoo Mo, a key Terraform employee, was accused of using a manipulative bot program</li>
 <li>His return to South Korea and cooperation with prosecutors aided the judge’s decision</li>
 </ul>
 
</div>



A key Terraform staff member was released from interrogation after a South Korean court judge determined there’s little reason he should be held.



Local outlets <a href="https://www.yna.co.kr/view/AKR20221006159651004?input=1195m" target="_blank" rel="noreferrer noopener">Yonhap</a> and <a href="https://n.news.naver.com/article/055/0001004369?sid=102" target="_blank" rel="noreferrer noopener">SBS</a> reported on Friday that the court dismissed an earlier-issued arrest warrant for the employee Yoo Mo. Judge Hong Jin-pyo of the Seoul Southern District Court reportedly considers detainment as unnecessary.



Yoo Mo, Terra’s head of general affairs, allegedly used bot programs to manipulate the firm’s stablecoin UST, prior to its depeg from the dollar and lead to the <a href="https://cms.blockworks.co/terra-collapse-could-spell-end-for-algorithmic-stablecoins/" target="_blank" rel="noreferrer noopener">Terra ecosystem’s collapse</a>. Subsequently, Terra’s collapse took down multiple centralized companies like Celsius, Voyager and Three Arrows Capital.



He was the first Terraform Labs’ employee to be arrested in connection with the incident.



Despite the accusations, Yoo is currently not a wanted individual. The fact that he didn’t deny operating and running the bot program in dispute was a critical factor in Judge Hong’s decision.&nbsp;



Other key considerations that the judge took into account were whether Luna was an “investment contract” under the capital markets law, the extent of Yoo’s complicity in the matter and that he voluntarily returned to South Korea after a warrant for his arrest was issued.&nbsp;



The report didn’t state where Yoo returned from, but it is believed the warrants were issued for Terraform employees who were and still may be in Singapore.



Still, the Judge declared that the crime of causing massive customer losses was serious and that some charges have been clarified.



A Terraform Labs spokesperson said recent developments reaffirm that the company and its stakeholders “remain subjected to a highly politicized and erratic legal environment in South Korea.”



“Terraform Labs has been — and will continue to be — in contact with all government agencies that have asked to communicate. The facts are on our side, and we look forward to the truth coming to light in the coming months,” the spokesperson added in an email to Blockworks.



South Korean prosecutors are reportedly now considering whether to reapply for an arrest warrant for Yoo. They’re also hastening moves to chase Terraform CEO Do Kwon, who claims he <a href="https://cms.blockworks.co/where-in-the-world-is-do-kwon-terra-ceo-says-im-not-on-the-run/" target="_blank" rel="noreferrer noopener">isn’t on the run</a>.&nbsp;



On Wednesday, the Ministry of Foreign Affairs <a href="https://www.passport.go.kr/new/board/notice.php?idx=7753&amp;sel=1" target="_blank" rel="noreferrer noopener">ordered</a> Do Kwon to hand over his passport within 14 days. The document would be automatically invalidated if he doesn’t comply.



The Seoul prosecutor’s office didn’t return Blockworks’ request for comment by press time.



This article was updated with Terraform&#8217;s comment on Oct. 8 at 2:33 am ET.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>
</ul>

market manipulation

Terraform Employee’s Arrest is Unwarranted, Judge Says

<div id="highlights-block_6315dfc517b5e" class="highlights">
 <ul>
 <li>Roche Freedman founding partner Kyle Roche is embroiled in an alleged pay-for-play scandal targeting Ava Labs competitors</li>
 <li>The law firm has argued Roche&#8217;s comments shouldn’t disqualify it from litigating crypto companies</li>
 </ul>
 
</div>



Roche Freedman, the law firm behind multiple legal actions against crypto companies, is in damage control mode after founding partner Kyle Roche was accused of taking payoffs to harm industry players.



The firm on Friday urged a New York federal court judge to deny Tether and Bitfinex’s <a href="https://cms.blockworks.co/roche-freedmans-legal-targets-cry-foul-after-video-leak/" target="_blank" rel="noreferrer noopener">requests to disqualify</a> it as co-lead counsel on its ongoing class action, saying one attorney’s actions shouldn’t hold consequences for the entire practice.



Roche allegedly <a href="https://cms.blockworks.co/ava-labs-ceo-rejects-report-alleging-conspiracy-with-law-firm/" target="_blank" rel="noreferrer noopener">struck a secret pact</a> with Avalanche developer Ava Labs to use litigation as a weapon against its competitors. In secretly-recorded videos published by CryptoLeaks, he admitted to being Ava Labs’ in-house crypto expert and that he was responsible for ensuring the US Securities and Exchange Commission stays distracted with other targets.



Roche <a href="https://medium.com/@kyleroche/my-response-b691563c255b" target="_blank" rel="noreferrer noopener">claims</a> information in the CryptoLeaks report is false and contains highly-edited footage. His law firm, however, told the court that the attorney “unfortunately” made untrue statements to impress the meeting attendants.



“He also made inappropriate remarks disparaging jurors and class members,” Roche Freedman said.



Shortly after the exposé, and despite denying the accuracy of the alleged conspiracy, Roche <a href="https://cms.blockworks.co/kyle-roche-moves-to-withdraw-from-multiple-lawsuits/" target="_blank" rel="noreferrer noopener">filed to withdraw</a> as an attorney for multiple class action lawsuits he initiated against companies including Tether, Bitfinex, Binance.US, Solana Labs and Dfinity — the latter two being direct Ava Labs competitors.&nbsp;



Roche Freedman’s lawsuits claim Solana Labs and Dfinity’s respective tokens, solana and internet computer, are unregistered securities. The firm’s Dfinity suit also alleges instances of insider trading.



<h3 class="wp-block-heading">Roche Freedman says Tether, Bitfinex case wasn&#8217;t filed for Ava Labs</h3>



Some sued parties don’t consider Roche withdrawing from the case as satisfactory. Tether and Bitfinex have demanded the entire firm be removed from their case, stating other Roche Freedman lawyers are known to hold substantial amounts of AVAX tokens.&nbsp;



In response, Roche Freedman said Roche is no longer part of the firm’s class action practice and has renounced his financial interest in the litigation against Tether and Bitfinex, which alleges the firms engaged in market manipulation to inflate token prices.



The firm also claimed that the Tether/Bitfinex case wasn&#8217;t filed at Ava Labs’ request, and that partner interest in Ava Labs or AVAX tokens doesn’t present a conflict of interest. It said the case was filed before Ava Labs’ relationship with the firm began.&nbsp;



However, a memorandum of understanding <a href="https://cms.blockworks.co/wp-content/uploads/2022/09/03092021cyrulnik.pdf" target="_blank" rel="noreferrer noopener">shows</a> a financial agreement between both parties commenced on September 30, 2019 — about a week before the case in question was <a href="https://www.courtlistener.com/docket/16298999/1/in-re-tether-and-bitfinex-crypto-asset-litigation/" target="_blank" rel="noreferrer noopener">filed</a> on October 6, 2019 by Kyle Roche and Velvel Freedman.



Tether and Bitfinex’s lawyer Elliott Greenfield didn’t return Blockworks’ request for comment.



Roche Freedman further argued Ava Labs isn’t a competitor to the parties sued — and that even if it were, there would be no disqualifying conflict.&nbsp;



“The idea, therefore, that the firm filed this case for Ava Labs, is both impossible, nonsensical, and untrue,” Roche Freedman said.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>
</ul>

market manipulation

Newsletter

Blockworks Research