Root Cause
Ostium uses off-chain PriceUpKeep Forwarder contracts that act as trusted price-feed relayers. Each Forwarder holds an authorized signer key; the on-chain oracle consumer accepts price updates without additional cross-validation if the update is signed by the registered key.
An attacker obtained the private key for one of these Forwarder signers — likely via credential theft, malware, or social engineering (root cause not publicly disclosed as of 2026-07-23). Once in possession of the key, the attacker could submit arbitrary prices directly to the price oracle contract.
// Simplified view of the vulnerable oracle update path
contract OstiumOracle {
mapping(address => bool) public authorizedForwarders;
function updatePrice(
bytes32 assetId,
uint256 price,
bytes calldata sig
) external {
address signer = recoverSigner(abi.encode(assetId, price), sig);
require(authorizedForwarders[signer], "Not authorized");
// No staleness check, no deviation band, no multi-source aggregation
latestPrice[assetId] = price;
}
}
Critically, the PriceUpKeep infrastructure was explicitly excluded from Ostium's bug bounty program scope, providing no financial incentive for security researchers to audit this path.
Attack Steps
| Step | Action | Detail |
|---|---|---|
| 1 | Key compromise | Attacker obtains the PriceUpKeep Forwarder's ECDSA private key |
| 2 | Submit fake BTC price | Pushes a fabricated BTC/USD price of ~$5,000 (actual market: ~$60,000) to the oracle contract |
| 3 | Open long position | Opens a leveraged long BTC position on Ostium at the manipulated low price |
| 4 | Restore / use real price | Price naturally corrects or attacker submits a second update; Ostium settles at real market price |
| 5 | Close and profit | Collects the difference (~$55,000 per BTC-equivalent unit) from the vault |
| 6 | Repeat | Multiple iterations drain the liquidity vault before the team detects anomalous PnL |
| 7 | Ostium pauses | Team halts trading ~1 hour after first malicious transaction |
Impact
- ~$18–23.75 million drained from liquidity vaults (sources vary; CoinDesk reported $18M, Cryptoticker reported $23.75M — final figure unconfirmed).
- Trading halted within approximately one hour of the first attack transaction.
- Ostium completed an eight-day investigation, hardened the oracle key management, and reopened on July 23, 2026.
- Ostium offered a white-hat bounty for return of funds.
Lessons for Auditors
- Include off-chain signing infrastructure in audit and bug-bounty scope: Price-feed relayer keys are as critical as any admin key. Excluding them from bounty programs removes the primary economic incentive to report vulnerabilities before they are exploited.
- Add deviation-band checks: On-chain price consumers should reject updates that deviate by more than a configurable threshold (e.g., 20%) from the last accepted price or an independent reference feed.
- Require multi-source aggregation for high-value price paths: A single authorized signer is a single point of failure. Require M-of-N agreement across independent data providers.
- Rate-limit price updates: Anomalously fast or large price moves should trigger a circuit breaker that pauses trading pending human review.
- Monitor Forwarder key usage: Alert on any signing activity from authorized forwarder addresses outside expected frequency windows.