Cozy Finance Double Exploit: Unchallenged UMA Oracle Proposal + Bridge Drain on Optimism

Two separate attackers hit Cozy Finance on Optimism in the same day: the first submitted a fraudulent UMA Optimistic Oracle price proposal that went unchallenged and triggered a $160K insurance payout; minutes later a second attacker drained a further $170K in a rapid bridge-and-exit sequence.

Root Cause

Cozy Finance uses the UMA Optimistic Oracle to price insurance claims. The UMA model works by allowing any party to submit a price proposal; it becomes canonical if no one disputes it within a challenge window. Cozy had no active dispute-monitoring bot, so the attacker's fraudulent proposal simply aged through the window unchallenged.

Vector 1 — Oracle fraud:

// UMA Optimistic Oracle pattern (simplified)
function requestPrice(bytes32 identifier, uint256 timestamp, bytes memory ancillaryData)
    external
{
    // Anyone can submit a price for a pending request
    proposals[keccak256(...)] = Proposal({
        proposer: msg.sender,
        proposedPrice: ATTACKER_CHOSEN_PRICE, // fraudulent claim value
        expirationTime: block.timestamp + LIVENESS_PERIOD // e.g. 2 hours
    });
}
// If no dispute arrives before expirationTime, price is accepted as truth
function settle(bytes32 identifier, ...) external {
    require(block.timestamp >= proposal.expirationTime, "Liveness not expired");
    // pays out based on fraudulent price — no further verification
    _disburseClaim(msg.sender, proposal.proposedPrice);
}

Vector 2 — Bridge drain:
A separate attacker (detected by Blockaid) identified the weakened post-exploit state, bridged assets to Optimism, and executed a 13-minute drain sequence for ~$170K.

Attack Steps

Step	Actor	Action	Detail
1	Attacker 1	Submit fraudulent UMA price proposal	Claims a maximal insurance payout for a fabricated loss event
2	—	Wait out liveness window	No dispute monitoring in place; window expires unchallenged
3	Attacker 1	Settle UMA oracle request	Fraudulent price accepted; ~$160K insurance payout triggered
4	Attacker 2	Bridge assets to Optimism	Separate actor reacts within minutes
5	Attacker 2	Drain remaining reserves	13-minute window; ~$170K extracted
6	Both	Exit funds	Assets bridged out of Optimism

Note: This is Cozy Finance's second Optimism exploit; the protocol previously lost ~$427K in August 2025.

Impact

Total loss: ~$330,000 ($160K oracle drain + $170K bridge drain)
Chain: Optimism (EVM)
Protocol: Cozy Finance (DeFi insurance)
Date: September 7, 2026

Lessons for Auditors

Protocols depending on UMA Optimistic Oracle MUST deploy dispute-monitoring bots. The liveness window is only a safety net if someone is actively watching for fraudulent proposals and willing to dispute them with a bond.
Insurance protocols carry compounded oracle risk: a compromised oracle both enables fraudulent claims and signals to other attackers that the protocol is unmonitored, making a secondary exploit more likely.
Implement emergency circuit-breakers: if a UMA settlement triggers a payout above a threshold, automatically pause further withdrawals for a short cool-down period.
Consider requiring a substantial proposer bond relative to the potential payout. If the bond is less than the expected payout, the oracle dispute game is economically skewed in the attacker's favor.
Post-incident monitoring gap: a protocol that has already been exploited is at elevated risk for follow-on attacks (as happened here). Incident response should include a temporary withdrawal pause and elevated monitoring for at least 48 hours.