Man-gone

There’s a recent trend of criminals saying “So long, Solana” as they dash for the exits with other people’s money. Hot off the heels of the Phantom wallet exploit this week, Mango has fallen foul of the most recent cash grab:

• Mango markets is a decentralised exchange on the Solana blockchain. They allow you to “lend, borrow, swap, and leverage-trade crypto assets“, and are governed by the Mango DAO.
• Last night a hacker walked away with over $100 million worth of crypto using two accounts and price manipulation.
• First, they funded an account with $5 million in USDC and opened a leveraged short for 483 million MNGO, the native exchange token.
• Joshua Lim explained that they then opened a second account in order to buy those tokens and boost the price artificially.
• By inflating price by ~30X, they had generated enough (fake) collateral to be able to take out a $116 million loan and flee.
• This completely drained liquidity on several key tokens and left the exchange reeling.
• Mango soon confirmed the attack was real and that they were “taking steps to have third parties freeze funds in flight“.
• This highlights the problem of accepting collateral on the back of relatively illiquid tokens, which are more vulnerable to price manipulation.

Mango stated this morning that the parties involved are “willing to negotiate“.