Flash Loan Attack Drains 160.26 BNB From CoreVault Insurance Pool

How the Oracle Manipulation Worked

A sophisticated flash loan attack struck CoreVault on BNB Smart Chain, exploiting a vulnerable price oracle. The attacker borrowed funds, manipulated the price feed, and drained the protocol’s InsurancePool. The total loss reached 160.26 BNB, valued at approximately $112,200.

The exploit targeted a critical weakness in how CoreVault sources price data. Instead of using a reliable oracle, the protocol relied on a manipulable feed. The attacker leveraged a flash loan to temporarily inflate the reported price. This distortion triggered an inflated redemption value. The attacker then redeemed assets worth far more than the pool could sustain. The result was a 33x inflation of redemption values.

The attack sequence began with a flash loan, a common DeFi mechanism allowing instant borrowing without collateral. The attacker used this loan to skew the oracle’s reported price upward. CoreVault’s system accepted the fake price as valid. Redemptions were calculated using this inflated figure. The attacker redeemed 33 times the normal amount. The InsurancePool, designed to cover losses, was emptied. The attacker repaid the flash loan and kept the difference.

Why Did the Protocol Fail to Detect the Anomaly?

CoreVault lacked real-time monitoring for sudden price spikes. The oracle did not cross-check against independent sources. No circuit breaker stopped the redemption process. The protocol’s logic trusted the single feed without validation. This gap allowed the attacker to act within a single transaction block.

The incident underscores the fragility of oracle-dependent DeFi protocols. Developers must implement multi-source price verification. Automated alerts for abnormal redemption patterns are essential. The attack serves as a wake-up call for the broader DeFi ecosystem. Future protocols should prioritize oracle security and anomaly detection. Users should audit any protocol’s price feed before depositing funds.

Frequently Asked Questions

How much did the attacker steal? The attacker drained 160.26 BNB from the InsurancePool. This equals roughly $112,200 at the time of the attack.

What was the root cause? The root cause was a manipulable price oracle. CoreVault relied on a single, vulnerable feed without cross-validation.

Was the attacker identified? The source does not confirm the attacker’s identity. The exploit used a flash loan, making it hard to trace without on-chain analysis.