Live data from Hacker News

Hackers drain $100M off Solana-based DeFi platform Mango Markets

p2eanalytics.com

91–100 of 105 posts

Re: Hackers drain $100M off Solana-based DeFi platform Mango Markets

#91

Earlier quoted context omitted.

I'm not sure if this has much specific relation to the Mango hack, but you raise an interesting point mentioning the possibility of a developer hacking his own network (who would be more qualified to do so?) - my broader point is this: there is a lot of incentive to get these platforms up and running, and not always a lot to build them safely and even less to truly audit them. Often the developers make their money up…

> What the average Joe need to know is that DeFi, while capable of producing huge gains, also comes with a lot of risk both market-wise and protocol safety-wise. Gains have to come from somewhere. If they're not backed by something in the real world - say capital investment making some process more efficient or whatever - then the alternatives are that they're illusionary or backed by shenanigans.

> Gains have to come from somewhere.

Yes. Key concept. There were people in the crypto space who believed they'd invented financial perpetual motion. If you could run money through enough different transactions, you'd get a net gain without doing anything in the real world. That mostly went away when the entire crypto sector crashed. The "Line goes up" video[1] covers this mindset.

[1] https://www.youtube.com/watch?v=YQ_xWvX1n9g

Re: Hackers drain $100M off Solana-based DeFi platform Mango Markets

#92
post #68
post #15

"According to Lim, the hacker funded the main account (account A) and offered 483mm units of $MNGO perps on the order book. The attacker then funded a second account (account B) with 5mm $USDC collateral. Then, he/she used the funds to buy the 483mm units of $MNGO perps (at a price of $0.0382 per unit). The perpetrator’s actions made $MNGO’s spot market price, reaching as high as $0.91. $MNGO/USD price of $0.91 per u…

> But the crypto sector doesn't want exchange regulation, so they don't have the "circuit breakers" that, say, the CBOE does. If this platform doesn't have circuit breakers, it's simply because either they didn't think of it, they didn't think it was important, or they thought it was a bad idea. There's nothing in crypto that clashes with the idea of a circuit breaker, it's completely orthogonal. And it shouldn't be…

> only some stock exchanges in the world have circuit breakers

Most of the US ones do. Here's a list of recent NYSE and NASDAQ trading halts.[1] The London Stock Exchange has trading halts. Euronext has circuit breakers that trip on 8% - 10% changes. [2] The Tokyo stock exchange has trading halts, but doesn't use them often.[3] China's stock exchanges use trading halts too much.[4].

That covers the major markets. Who doesn't have some system to stop trading during big price swings?

[1] https://www.nyse.com/trade-halt-current

[2] https://www.euronext.com/en/news/trading-safeguards-euronext...

[3] https://www.jpx.co.jp/english/markets/derivatives/suspended/

[4] https://www.scmp.com/business/china-business/article/2174454...

Re: Hackers drain $100M off Solana-based DeFi platform Mango Markets

#93
post #15

"According to Lim, the hacker funded the main account (account A) and offered 483mm units of $MNGO perps on the order book. The attacker then funded a second account (account B) with 5mm $USDC collateral. Then, he/she used the funds to buy the 483mm units of $MNGO perps (at a price of $0.0382 per unit). The perpetrator’s actions made $MNGO’s spot market price, reaching as high as $0.91. $MNGO/USD price of $0.91 per u…

[deleted]

Re: Hackers drain $100M off Solana-based DeFi platform Mango Markets

#94
post #74
post #15

"According to Lim, the hacker funded the main account (account A) and offered 483mm units of $MNGO perps on the order book. The attacker then funded a second account (account B) with 5mm $USDC collateral. Then, he/she used the funds to buy the 483mm units of $MNGO perps (at a price of $0.0382 per unit). The perpetrator’s actions made $MNGO’s spot market price, reaching as high as $0.91. $MNGO/USD price of $0.91 per u…

It is a wash trade, which is illegal in a regulated market.

Wash trading (under that term) is illegal, but I looked it up and the writing on it seems like it mainly applies to the context of creating higher volume, not price[1], and the latter is what the attacker used here. Margin lenders on conventional markets generally avoid this attack by incorporating volatility in their collateral requirements -- a recent rally in the price would mean higher volatility and thus more collateral required.

[1] https://en.wikipedia.org/wiki/Wash_trade

https://www.investopedia.com/terms/w/washtrading.asp

Re: Hackers drain $100M off Solana-based DeFi platform Mango Markets

#95

Hate to be that guy, but someone has to say it... In this case the code worked as expected and the "attacker" played within the rules of the game. Except they "won" too much. That's not supposed to happen.

"As expected" is doing a lot of lifting here. In some sense, this is true for all hacks. The code is just doing what you told it to do when it returns to some gadget in libc after the return address is smashed. All exploits are making a program do what it says it does but where that behavior is different than what the developers hoped it would do.

Not quite. Per this other comment[1], there's a difference between correctness vs fitness for purpose. The code was correct -- if, previously you had walked through the logic of the attack with them, the coders would have said, "yep, that's what we want it to do -- lend that much, based on those oracles' prices".

They just didn't realize that there are dangers of using a price oracle for collateral valuation that has recently shown a sharp upward movement. (Which fals under "fitness for purpose".)

So the code correctly lent to someone at Mango's current valuation, it just didn't require the optimal-in-hindsight collateral ratio for such a volatile asset.

[1] https://news.ycombinator.com/item?id=33173028

Re: Hackers drain $100M off Solana-based DeFi platform Mango Markets

#96

Code is law working out real well over here. The code said that we should value MNGO at the current spot price, so that's what the code did, and poof went the entire network. In the real world we have things like leverage ratios, anti-manipulation laws, circuit breakers, etc. Some of this is regulatory, and others are just things we figured out were good ideas many years ago. I think there's a sense of hubris in the…

Yes and: Software bugs and law "bugs" are orthogonal. My hunch is their respective bugs don't cancel each other out, but rather the mismatch somehow makes each side worse.

FWIW, I recently read Seeing Like a State and am still trying to process what trying make society more legible (manageable) even means.

Re: Hackers drain $100M off Solana-based DeFi platform Mango Markets

#97
post #68
post #15

"According to Lim, the hacker funded the main account (account A) and offered 483mm units of $MNGO perps on the order book. The attacker then funded a second account (account B) with 5mm $USDC collateral. Then, he/she used the funds to buy the 483mm units of $MNGO perps (at a price of $0.0382 per unit). The perpetrator’s actions made $MNGO’s spot market price, reaching as high as $0.91. $MNGO/USD price of $0.91 per u…

> But the crypto sector doesn't want exchange regulation, so they don't have the "circuit breakers" that, say, the CBOE does. If this platform doesn't have circuit breakers, it's simply because either they didn't think of it, they didn't think it was important, or they thought it was a bad idea. There's nothing in crypto that clashes with the idea of a circuit breaker, it's completely orthogonal. And it shouldn't be…

Doesn't a circuit breaker imply human intervention? The point of DeFi is that you get some code running on a blockchain then release control. No central point of control. How this is going to work is beyond me. But without it a blockchain is just an expensive database.

Re: Hackers drain $100M off Solana-based DeFi platform Mango Markets

#99
post #68

Earlier quoted context omitted.

> But the crypto sector doesn't want exchange regulation, so they don't have the "circuit breakers" that, say, the CBOE does. If this platform doesn't have circuit breakers, it's simply because either they didn't think of it, they didn't think it was important, or they thought it was a bad idea. There's nothing in crypto that clashes with the idea of a circuit breaker, it's completely orthogonal. And it shouldn't be…

Doesn't a circuit breaker imply human intervention? The point of DeFi is that you get some code running on a blockchain then release control. No central point of control. How this is going to work is beyond me. But without it a blockchain is just an expensive database.

A circuit breaker doesn't imply human intervention. U.S. regulations have three levels of a circuit breaker, which are set to halt trading when the S&P 500 Index drops 7%, 13%, and 20%. Circuit breakers for individual securities are triggered whether prices move up or down.

Re: Hackers drain $100M off Solana-based DeFi platform Mango Markets

#100
post #81
post #13

This attack was interesting because it's an economic, not software hack. https://twitter.com/joshua_j_lim/status/1579987648546246658?... is the source overview. The software all worked as expected, and it's difficult to see exactly which step you'd go "no, the person shouldn't have done that". Arguably the fault is with the loan protocols that valued collateral at the instant spot price rather than some kind of time-…

The person shouldn't be able to wash trades, that's the core of this "hack".

Yes, this is true.
Post reply on HN