! I'm super excited to start writing on Vertical and am excited about the prospect of being a consistent creator on this new platform. Let's dive in!

, the integration of oracles is ubiquitous. Oracles enable crucial functionality for many of the top lending protocols, as these dApps rely on very sensitive, verifiable data. The widespread use and reliance on oracle data thus opens protocols up to several attack vectors related to an 

. These vulnerabilities usually originate when transactions and interactions are executed based on compromised, malicious, or inaccurate data feeds. Attack vectors may affect all processes linked to a specific oracle input, whether that be an unwarranted liquidation or malicious arbitrage trade. 

A common and costly oracle exploit comes in the form of a 

 and has resulted in $ hundreds of millions in lost funds. A 

 is a particular form of smart contract in which an undercollateralized loan is taken and repaid simultaneously in the same block. They provide instant, sizable liquidity and the mechanisms within the contract negate any default risk. In global crypto markets, flash loans are beneficial when performing arbitrage between exchanges; they improve market efficiency.

Because flash loans must be settled in the same block, there is virtually no limit to the amount of money that can be borrowed. As a particular transaction can influence asset prices instantaneously, massive transactions can manipulate prices to an exponential degree. If oracles are not prepared for this kind of volatility, this scenario can be exploited to manipulate the prices of assets and collateral. 

The most common attack vector using flash loans is to 

manipulate sole price oracles of a decentralized exchange (DEX)

. The following demonstrates a sequential flash loan attack leading to protocol losses:

A memorable exploit came in mid-2021, when the pools of decentralized lending protocol 

. The protocol was originally a Compound fork but had expanded to providing markets for smaller cap tokens and derivative LP tokens like yUSD. Some of these tokens required a custom oracle proxy developed by the Cream team itself — this was in fact what introduced the flash loan attack vector. The oracle calculated a custom pricePerShare function using on-chain calls in Curve’s 4Pool and yUSD contracts, which was manipulated by an attacker who used subsequently used 

. Over $130 million was stolen, resulting in one of the costliest oracle exploits to date. 

While flash loan exploits involving oracle manipulation are relatively sparse, billions of $ have been stolen from projects, with many on the 

, which depicts money stolen from crypto projects due to hacks/exploits, resulting from the use of flash loans and oracle mispricings. 