The Impact of Oracles on DeFi Protocols Amid Rampant Flash Loan Attacks
TechFlow Selected TechFlow Selected
The Impact of Oracles on DeFi Protocols Amid Rampant Flash Loan Attacks
How do hackers use flash loans to attack DeFi protocols?
Navigating Web3 tides with focused insightsAuthor: Zheng Zheng, TechFlow
A few days ago, Mango, a DeFi project on the Solana ecosystem, suffered a flash loan attack by hackers, resulting in losses exceeding $100 million. It is reported that the hackers drained Mango's liquidity by manipulating oracle prices.
Today, let’s discuss what flash loans are, how hackers exploit them to attack DeFi protocols, and the importance of oracles to DeFi protocols.
01 Financial Innovation in the Blockchain World—Flash Loans
Flash loans were initially proposed by Marble Bank, which claimed: "Flash loans can help traders borrow funds from Marble Bank, buy tokens on one decentralized exchange (DEX), sell them at a higher price on another DEX, and automatically pocket arbitrage profits in a single transaction."
The principle of flash loans works as follows:
1. Users borrow large amounts of funds from a protocol without collateral;
2. Users can use these funds for any beneficial operation (e.g., arbitrage, bridge funding, manipulating token prices for profit);
3. Finally, users must repay both principal and interest to the protocol. If they fail to repay, the entire transaction is reverted, ensuring the protocol’s funds remain secure.
The mechanism of flash loans relies on the atomicity of smart contracts—meaning all steps must either fully succeed or completely fail, with no partial outcomes.
When all operations succeed, the flash loan completes successfully: the protocol earns interest from lending and recovering funds, while users profit from various strategies using the borrowed capital. However, if users fail to generate sufficient returns during fund usage and end up short on repayment, the entire transaction reverts. In this case, only gas fees are lost by the user, while the protocol suffers no financial loss.
From the mechanics of flash loans, we can see that the key to successful execution lies in how users can quickly generate profits within a single transaction using borrowed funds.
As flash loans evolved, it became evident that among all possible uses, the most profitable activity turned out to be hacking DeFi protocols via flash loan-funded price manipulation. Let’s now examine how hackers leverage flash loans for profit.
02 How Flash Loans Became Tools for Hacker Profits
The current blockchain world resembles a dark forest, filled with hidden risks. Hackers act as relentless predators, constantly seeking—or even creating—profitable opportunities.
Flash loans, which provide instant access to large uncollateralized funds, perfectly meet hackers’ need for low-risk capital to manipulate prices. Most current attacks on DeFi protocols using flash loans involve price manipulation. Below is an illustrative example:
1. The hacker borrows a large sum via a flash loan;
2. The hacker pre-positions funds in relevant tokens within a DeFi protocol;
3. Uses the large capital to artificially inflate the price of those tokens on a DEX;
4. The manipulated price is fed through an oracle to the DeFi protocol;
5. Upon receiving the manipulated price feed, the DeFi protocol allows the hacker to collateralize their previously positioned tokens at the inflated value and borrow large sums;
6. The hacker repays the flash loan and walks away with the remaining funds—an elegant "empty-handed" heist.
A critical point in this process is that the DeFi protocol accepted manipulated pricing data from the oracle, leading to incorrect lending decisions.
Since DeFi protocols typically rely on oracle-fed prices, accurate price feeds have become the cornerstone of DeFi security.
03 Pyth—A High-Fidelity On-Chain Oracle Network
In the Mango hack incident, both Mango’s official team and its CEO discussed the role of the oracle, emphasizing that the oracle’s quoted prices were normal and not anomalous.
This brings us to Pyth, the oracle involved. What makes Pyth special? Let’s explore.
The Hidden Background of Pyth
After careful information analysis, Jump Crypto emerges as the likely backer and builder of Pyth. Jump Crypto is the crypto investment arm of Jump Trading, a high-frequency trading giant, and participated in the recent high-profile Aptos funding round.
For high-frequency trading, timely and accurate price data is crucial to success. Jump takes network speed to extreme levels—for instance, in 2018, Jump partnered with Citadel and five other HFT firms to lay a trans-Pacific fiber-optic cable named "Go West" connecting Chicago and Tokyo to gain faster futures market data.
In Jump Crypto’s official documentation, significant emphasis is placed on Pyth, explicitly stating that Jump contributed directly to Pyth’s code development. Leveraging its influence, Jump has also onboarded numerous traditional financial exchanges and cryptocurrency exchanges as data publishers on the Pyth network.
Pyth’s Operating Model
The Pyth network involves three main roles:
-
Publishers provide price feeds and receive part of the data fees as compensation. Publishers are typically market participants capable of accessing timely and accurate price data. Pyth rewards publishers proportionally based on the volume of new price data they contribute
-
Consumers read price feeds, integrating the data into smart contracts or decentralized applications, and may optionally pay data fees. Consumers can be on-chain protocols or off-chain applications
-
Delegators stake tokens to earn data fees, but risk losing their staked assets if the oracle provides inaccurate prices
These roles interact within the Pyth network through four core mechanisms:
-
Price Aggregation Mechanism: Combines individual publisher feeds into a single product price feed. Designed to produce stable prices resilient to manipulation by a small number of publishers
-
Data Staking Mechanism: Allows delegators to stake tokens to earn data fees. Delegators collectively determine each publisher’s weight in the aggregated price. This mechanism also determines whether delegators’ stakes are slashed due to inaccuracies. It collects data fees from consumers and distributes a portion to delegators, with the remainder going to a reward pool for publishers
-
Reward Distribution Mechanism: Determines how rewards from the reward pool are allocated to data publishers. Prioritizes high-quality feed providers and reduces rewards for low-quality contributors
-
Governance Mechanism: Sets high-level parameters for the above three mechanisms
In short, publishers supply price data; consumers can opt for insurance-like protection to ensure data accuracy; and delegators serve as guarantors—if prices significantly deviate from reality, delegators must compensate paying consumers.
Moreover, the model includes safeguards such as price fitting algorithms and preventive measures against malicious behavior, reflecting Jump’s professional expertise and dedication to Pyth. Interested readers are encouraged to review the Pyth whitepaper for deeper insights.
Pyth Token Distribution: The total PYTH token supply is fixed at 10,000,000,000, with no future increases. Initially, 85% of tokens are locked in contract, subject to a 1-year lock-up period followed by monthly linear unlocking over 7 years, gradually increasing the circulating supply. The remaining 15% of PYTH tokens are immediately unlocked. Locked and unlocked tokens will be distributed as shown below.
Potential Issues and Risks with Pyth
Currently, PYTH tokens have not been released, so the full economic implications remain unclear. Under the current model, protocol revenue comes from consumer payments, which function more like optional insurance. Even without payment, consumers can still access real-time Pyth price data. Thus, after token launch, whether consumers choose to pay—and at what rate—will be crucial to the protocol’s profitability.
Alternatively, Pyth could later restrict access to paid users only, but this raises questions about whether users might simply migrate to alternative oracles instead.
Conclusion
Backed by Jump, Pyth benefits from deep expertise in high-frequency trading and sophisticated modeling. Whether this model proves effective in the Web3 world remains to be seen through real-world implementation.
Join TechFlow official community to stay tuned
Telegram:https://t.me/TechFlowDaily
X (Twitter):https://x.com/TechFlowPost
X (Twitter) EN:https://x.com/BlockFlow_News
