Security is always evolving.

If you stop learning, you expose yourself to vulnerabilities.

Let’s explore two of the newest mitigation technique on the block: 🧵 Many economic exploits and oracle manipulation attacks are a result of treating high and low volatility assets the same.

📈❌📉

This puts undue risk on the protocol, as the inherent risk of higher volatility assets is not priced in.

A large MEV bot was recently hacked for almost 20M. It all happened in one block.

Here's what we know 🧵 It appears a (malicious?) validator spliced in their transaction, stealing funds from a MEV bot attempting to front-run.

Note how this causes the backrun (every 3rd tx) to fail in the previous screenshot.

@RaydiumProtocol just got hacked. It doesn't seem like a smart contract vulnerability.

Here's our analysis. The attacker is repeatedly invoking the withdraw_pnl instruction to withdraw fees from Raydium pools.

solscan.io/tx/3iyVofF2PSa…

1/ Alameda has been a long-standing, loyal security audit client of ours. We also work closely with many projects on Solana, many of which are directly or indirectly affected by FTX’s insolvency.

Here’s our perspective. 2/ Even before FTX filed for bankruptcy, there were some red flags. A few days prior, their Solana USDC Account ran out of funds for withdrawals.

https://twitter.com/NotDeGhost/status/1590469676337070081

We’re continuing to investigate the recent Mango Markets hack.

Let’s clear up some misinformation. 🧵 At a high level,

1. This was not a flashloan attack
2. The attacker addresses were funded 5.5M via FTX
3. It appears the attacker manipulated prices across all exchanges, not just Solana oracles

Rent Thief:

1/ An MEV bot has been stealing rent from @solendprotocol by abusing the account initialization process.

This is the story of the curious rent thief ; 🧵 2/ Due to Solana’s txn-wide compute budget, the 6 accounts used to store data on the new reserves/assets are split into 2 txns. This is where the thief comes in:

Between txns (~40s window), the account has rent but no owner; allowing the thief to take over and reclaim the rent.

1/ @nirvana_fi was hacked for $3.49 M a few hours ago.

How did this happen? 🧵 2/ This hack beared many similarities to previous hacks. Similar to the @Crema_Finance hack, this too used Solend flashloans.

The attacker’s program was also uploaded on-chain and closed immediately afterwards.

solscan.io/account/62o4Ui…

@Crema_Finance was recently hacked for over $6M. Unlike previous attacks, this hacker used Solend flashloans to drain the pool. We’re working closely with the Crema team to help resolve this issue.

In the meantime, we’ll be sharing what we know about the exploit 🧵 In order to utilize flashloans, the attacker had to deploy their own onchain program. Unfortunately, this program was quickly closed after the exploit.

solscan.io/account/FRAKoK…

We were engaged by the @cega_fi team to perform a security audit of their smart contract code and we’re proud to announce its successful conclusion! Code quality was high, and all vulnerabilities were patched and confirmed.

Deep dive below into interesting technical findings: 🧵 1/ Incorrect withdrawn funds due to missing account reload (OS-CEG-ADV-01):

All withdrawal requests are processed via a withdraw queue, and the amount of USDC tokens to be returned is calculated based on the value of USDC tokens in vault over redeemable mint supply.

SPL-token-swap:

This February, we discovered a critical rounding exploit in the Solana Program Library token-swap implementation. With over $74 M at risk, this was one of the most impactful bugs we’ve reported.

Let’s take a deep dive: 1/ 2/ When implementing an arbitrage bot, we came across some unexpected behavior. We were somehow getting tokens out of nothing. In other words, we were able to put in 0 tokens and get out 1 token.

1/ In our recent audit report on @JetProtocol’s governance program, we listed 13 findings and 4 vulnerabilities. One of these vulnerabilities stand out from the others: OS-JET-ADV-01

Let’s take a deep dive into this rounding error, the implications, as well as its exploitability 2/ In Jet’s original conversion code between tokens and shares, all rounding was done via floor division. This meant that the correctness of the code depended on floor division to not be in favor of the user.