Root Cause
Injective is a Cosmos-SDK Layer 1 with a built-in derivatives exchange (binary options, perpetuals). The binary options module generates market identifiers (market_id) by hashing several parameters including the denomination. A market ID collision vulnerability allowed an attacker to confuse settlement accounting between markets.
Critically, the binary options settlement path had a missing-price fallback: when the designated oracle cannot provide a price at expiration, the module falls back to a full refund of the initial payout. The attacker weaponized this as the primary drain mechanism.
// Simplified illustration of the vulnerable settlement path (Go pseudocode)
func settleBinaryOptionsMarket(market Market, oracle Oracle) {
price, err := oracle.GetPrice(market.OracleTicker)
if err != nil || price == nil {
// 🚨 refund path: returns full payout to attacker-controlled positions
refundAllPositions(market)
return
}
settleAtPrice(market, price)
}
Attack Steps
| # | Action |
|---|---|
| 1 | Attacker creates 299 binary options markets as admin, each referencing a self-controlled oracle feed named "Frontrunner" |
| 2 | Each market is configured with expiration and settlement timestamps ~10 seconds apart — forcing near-instant settlement |
| 3 | At settlement time, the "Frontrunner" oracle deliberately fails to provide a price |
| 4 | Settlement module hits the refund path, releasing funds to attacker-controlled long positions |
| 5 | The market_id collision between some of these markets and legitimate markets amplifies the drain beyond the attacker's own positions |
| 6 | ~$4.9M drained; attacker bridges to Ethereum (address: 0x5a18…69ea holds ~1,980 ETH) |
| 7 | Injective chain halts at block 181,027,006 (16:10 UTC) for 3h 42m; resumes at block 181,027,007 (19:52 UTC) |
| 8 | Emergency v1.20.3-safeharbor.1 patch deployed: adds insurance-fund denomination check, disables binary-options settlement on mainnet |
Impact
- Protocol: Injective (binary options module, application layer — not the base chain itself)
- Chain: Injective mainnet (Cosmos/IBC)
- Loss: ~$4.9M
- Chain downtime: 3 hours 42 minutes (Injective disputed "halt" framing, calling it an "accelerated network upgrade")
- Patch: Binary options settlement disabled on mainnet indefinitely pending redesign
Lessons for Auditors
- Admin-controlled oracle designation is a critical permission. Any pathway where a market creator can specify their own oracle feed — and that feed can influence settlement amounts — must be tightly access-controlled or sandboxed. External oracle providers should be whitelisted, not freely assignable.
- Refund-on-missing-price is an exploitable invariant. Settlement paths that release funds on oracle failure are trust assumptions about oracle liveness. An attacker who controls the oracle can guarantee liveness failure on demand. Instead, missing prices should freeze markets and require governance intervention, not trigger automatic refunds.
- Hash-based market IDs must include all distinguishing parameters. ID collision bugs arise when two logically distinct markets share a hash. Ensure that all parameters that meaningfully differ between markets (denomination, collateral type, oracle identifier) are included in the hash preimage, and add uniqueness constraints at market creation.
- Rate-limit or throttle market creation. Creating 299 markets to amplify a single exploit path is a quantitative signal. Protocols that allow permissionless or low-barrier market creation should enforce rate limits, creation fees, or governance approval for markets above a certain exposure.
- Application-layer bugs can halt base chains. The 3.7-hour halt on Injective (a Cosmos L1) stemmed from an application-level derivatives bug, not a consensus flaw. Modular chains should architect circuit-breakers at the module level that can isolate a broken module without halting the entire network.