CoreVault insurance pool drained ~$181K in BNB oracle manipulation
Security & Exploits ·
Attacker used a flash loan of WBNB to skew PancakeSwap spot price and trigger an inflated redemption payout on BNB Chain.
A BNB-farming vault called CoreVault lost approximately $181,000 after an attacker manipulated the price oracle it relies on for redemptions. The exploit targeted the OSK token, trading around $0.0141, and was executed through a flash loan rather than a bug requiring privileged access. Four distinct sources have reported on the incident, with some estimates placing the loss closer to $175K and the attacker's net proceeds at roughly $111K to $112K.
The mechanism centered on how CoreVault's redeemPrincipal function calculates BNB payouts. The vault prices BNB principal redemptions using a spot-price-derived figure called wbnbPerUsd, sourced from OracleLib's three-source median. When TWAP or average-price windows are not fully populated, that median falls back to the manipulable PancakeSwap spot price. The attacker exploited this gap by flash-borrowing about 207,000 WBNB from Moolah, then dumping roughly 195,000 WBNB into the WBNB/USDT pair to artificially inflate the spot price feed.
With the oracle skewed, the attacker called redeemPrincipal, which computed an inflated bnbAmount based on the manipulated wbnbPerUsd. This triggered Treasury.payoutBnb, which routed through InsurancePool.withdrawReserve and paid out approximately 260 BNB. That payout drained roughly 259 BNB, worth about $181K, from the insurance reserve. The attacker then swapped the WBNB back to repay the flash loan, netting a final profit of around 160 BNB, or approximately $112K, after accounting for loan and swap costs.
The attacker address carried out the transaction in a single sequence, and the incident has drawn attention on social media alongside the multiple reports tracking the loss figures. The discrepancy between the roughly $181K drained from the insurance pool and the approximately $111K to $112K the attacker ultimately netted reflects the costs of executing and unwinding the flash loan.
Unresolved at this stage is whether CoreVault or its affiliated protocols plan to patch the oracle's fallback-to-spot-price behavior or require fully populated TWAP windows before future redemptions. It also remains unclear whether any funds will be recovered or if the insurance pool will be replenished, and whether other vaults sharing the same OracleLib implementation face similar exposure.