Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers drain $100M off Solana-based DeFi platform Mango Markets

p2eanalytics.com

Post reply on HN
Print view View original

41–50 of 105 posts

Re: Hackers drain $100M off Solana-based DeFi platform Mango Markets

#41

Post by squeaky-clean »

"Then, he/she used the funds to buy the 483mm units of $MNGO perps (at a price of $0.0382 per unit). The perpetrator’s actions made $MNGO’s spot market price, reaching as high as $0.91"

Is the second sentence sentence missing some words? Or is there something specific about Mango that makes this make sense? If 483mm units were bought for $0.0382 per unit (is that the average price, a fixed price?), why did the spot price suddenly increase 30x, was there that big of a spread in the order book? Also how does that add up to $5mm USDC? Isn't $0.0382 x 483mm = $18.4506mm?

Re: Hackers drain $100M off Solana-based DeFi platform Mango Markets

#42

Post by quickthrower2 »

bouncycastle wrote: post #20

Hate to be that guy, but someone has to say it... In this case the code worked as expected and the "attacker" played within the rules of the game. Except they "won" too much. That's not supposed to happen.

Creating and selling worthless tokens = Entrepreneur

Obtaining someone elses tokens because code had flaw = Hack

Re: Hackers drain $100M off Solana-based DeFi platform Mango Markets

#43

Post by TheSpiceIsLife »

mattwilsonn888 wrote: post #31
cuteboy19 wrote: post #27

Earlier quoted context omitted.

Many of the recent bridge hacks were easily preventable. Unfortunately when the dev himself is the hacker, no amount of active development would fix these issues

I'm not sure if this has much specific relation to the Mango hack, but you raise an interesting point mentioning the possibility of a developer hacking his own network (who would be more qualified to do so?) - my broader point is this: there is a lot of incentive to get these platforms up and running, and not always a lot to build them safely and even less to truly audit them. Often the developers make their money up…

Sounds like what the space needs is regulation...

You know, to provide assurance that automated protocols are written strongly, and legal recourse against bad actors.

Re: Hackers drain $100M off Solana-based DeFi platform Mango Markets

#44

Post by anonymoushn »

leereeves wrote: post #28
Animats wrote: post #15

"According to Lim, the hacker funded the main account (account A) and offered 483mm units of $MNGO perps on the order book. The attacker then funded a second account (account B) with 5mm $USDC collateral. Then, he/she used the funds to buy the 483mm units of $MNGO perps (at a price of $0.0382 per unit). The perpetrator’s actions made $MNGO’s spot market price, reaching as high as $0.91. $MNGO/USD price of $0.91 per u…

> The perpetrator’s actions made $MNGO’s spot market price, reaching as high as $0.91. If the "perpetrator" sold 483mm units on one account and bought 483mm units on another account, why did the market price rise so much?

they separately bought a bunch of tokens on centralized exchanges to manipulate the price of the derivatives

Re: Hackers drain $100M off Solana-based DeFi platform Mango Markets

#47

Post by anonymoushn »

mewse wrote: post #14

NB: This article is about the $115 million Mango Markets hack of a few days ago, not about the $127 million exploit of Binance's blockchain from last week or the $160 million Wintermute hack from last month or the $1.2 billion-with-a-'b' Acala hack from the month before, or...

the Mango Markets attack was a few hours ago.

Re: Hackers drain $100M off Solana-based DeFi platform Mango Markets

#48

Post by anonymoushn »

squeaky-clean wrote: post #41

"Then, he/she used the funds to buy the 483mm units of $MNGO perps (at a price of $0.0382 per unit). The perpetrator’s actions made $MNGO’s spot market price, reaching as high as $0.91" Is the second sentence sentence missing some words? Or is there something specific about Mango that makes this make sense? If 483mm units were bought for $0.0382 per unit (is that the average price, a fixed price?), why did the spot p…

First question: yes, the missing part is that the attacker also had to buy a bunch of spot mango tokens on centralized exchanges to drive the price up after establishing the large position.

Second question: Mango Markets lets you trade perpetual futures with leverage, so you don't need collateral equal to the notional value of the contracts you buy.

Re: Hackers drain $100M off Solana-based DeFi platform Mango Markets

#50

Post by datalopers »

nl wrote: post #13

This attack was interesting because it's an economic, not software hack. https://twitter.com/joshua_j_lim/status/1579987648546246658?... is the source overview. The software all worked as expected, and it's difficult to see exactly which step you'd go "no, the person shouldn't have done that". Arguably the fault is with the loan protocols that valued collateral at the instant spot price rather than some kind of time-…

> valued at the instant spot price

The entire cryptocurrency hype machine is predicated upon quoting market capitalization based on instantaneous spot prices. Nobody thinks about liquidity until it's gone.

Post reply on HN