Price-Manipulation Attacks Drain DeFi Lending Protocols of Liquidity
Decentralized finance (DeFi) lending protocols automate borrowing through smart contracts, allowing users to deposit collateral and access liquidity without traditional intermediaries. However, this efficiency depends on reliable price information.
Attackers can exploit weaknesses in pricing systems by manipulating temporary market distortions into permanent bad debt. The core issue is not necessarily a hacked oracle, but rather an attacker distorting prices in a market from which the oracle reports.
For example, if a token trades at $10 and an attacker pushes its observable price to $50, a lending protocol may treat the same collateral as five times more valuable. The attacker can then borrow liquid assets such as DOLA, ETH or BTC against the inflated position.
In April 2022, Inverse Finance demonstrated this risk when its Anchor money market suffered an oracle manipulation involving INV and an INV/WETH market on SushiSwap. Approximately $15.6 million in crypto assets was borrowed against inflated INV collateral.