CoreVault BNB farming vault drained of ~$181K via oracle manipulation attack using flash-loaned WBNB to artificially inflate spot price on PancakeSwap.
Security & Exploits ·
A BNB-farming vault on BNB Chain suffered a loss of approximately $181,000 on November 3rd when an attacker exploited an oracle manipulation vulnerability. The vault, CoreVault, relied on a manipulable PancakeSwap spot price to determine BNB redemption amounts. An attacker flash-borrowed roughly 207,000 WBNB and deposited 195,000 WBNB into the WBNB/USDT pair, artificially inflating the oracle's price signal for WBNB in USD terms.
The attack exploited how CoreVault calculated redemption amounts. The redeemPrincipal function computed the BNB payout by multiplying the redeemable USD value by the manipulated wbnbPerUsd rate sourced from OracleLib.getAccountingPrices. The oracle's median calculation across three sources degraded to the manipulated spot price when time-weighted average price and average windows remained unfilled. This flow enabled the treasury to pay out approximately 260 BNB from the insurance pool.
The attacker subsequently swapped the borrowed WBNB back and repaid the flash loan, retaining a net profit of roughly 160 BNB, equivalent to approximately $112,000. The insurance pool was drained of approximately 259 BNB in the process. The vulnerability underscores reliance on spot prices for financial calculations when time-window averaging mechanisms remain incomplete or unavailable.