Once again, the risks in decentralized finance became clear when Ostium, a derivatives platform on Arbitrum, had to halt all trading after an attacker took advantage of its price-feed system. This breach let the attacker steal up to $18 million in USDC from the main liquidity vault.
Before the attack, Ostium had more than $63 million locked in its platform, which lets users trade perpetual contracts on real-world assets like commodities, stocks, and currencies.
How the Attacker Exploited the System
Blockchain security firm Blockaid found that the attacker did not use a typical private key leak. Instead, they took advantage of the protocol’s automated price-reporting system:
- Price Forwarder Abuse: The attacker used a registered forwarder system called PriceUpKeep to send in future-dated, authorized price reports into the system.
- Fabricated Trading Profits: By sending fake price data into the settlement engine, the attacker created large, but false, trading profits.
- Vault Liquidation: The protocol’s smart contracts accepted these fake profits as real and sent about $18 million in USDC from the liquidity pool to the attacker’s wallet.
The Risk of Overlooked Security Assumptions
This breach shows a common problem in many DeFi protocols: they rely too much on trusted price keepers.
Ostium’s official security bug bounty explicitly assumed that registered price forwarders were secure by default, excluding compromised keeper scenarios from its bug disclosure scope. Because the protocol’s smart contracts trusted incoming oracle feeds without secondary verification, the system paid out millions on trades that never actually made money.
Broader Industry Impact
While independent on-chain analysts continue to debate the final loss figure, with some estimates placing the drained amount closer to $11.8 million, the incident highlights an ongoing wave of oracle-based exploits hitting liquidity pools.
Until decentralized protocols implement strict cryptographic checks on automated price deliverers, liquidity providers remain vulnerable to system-level manipulation
​
