Cowrie Research

nirvana-finance-ana-buy-side-pricing-input-manipulation-treasury-drain-2022-07-28

13 min read

Nirvana Finance ANA Buy-Side Pricing-Input Manipulation / Treasury Drain (2022-07-28)

  • Name: Nirvana Finance ANA buy-side pricing-input manipulation / treasury drain
  • Date: 2022-07-28
  • Protocol: Nirvana Finance
  • Chain: Solana
  • Category: issuance-redemption solvency asymmetry / oracle manipulation / protocol-native treasury drain / flash-loan exploit
  • Loss: about $3.49M-$3.57M in extracted stablecoins, with protocol statements saying the drain removed nearly all external reserve assets and left more than $10M of ANA/NIRV ecosystem value functionally unbacked
  • Summary: Nirvana’s native AMM let users buy ANA and then cash ANA back out against the protocol’s treasury. Nirvana’s own postmortem said the attacker manipulated inputs to the program so ANA could be bought at an artificially low price. With a roughly $10.25M Solend flash loan, the attacker pushed through Nirvana’s buy path, which moved ANA’s quoted price from about $8 to about $24 while still letting the acquired ANA be sold back into treasury-held stablecoins. The decisive failure was not just flash loans are powerful; it was that Nirvana’s issuance side could be made to quote ANA too cheaply while the treasury payout side still honored ANA as if the quote were honest. The attacker therefore turned Nirvana’s own protocol-native pricing loop into a spread they controlled, exited with about $3.5M of USDT/USDC, and left the reserve-backed design without the collateral it needed to keep ANA and NIRV functioning.
  • Trigger / entry point:
    • The attacker targeted Nirvana’s Solana program at nirkXSE28jCQoK8SmKWqxXz3L9vbSRGKS24iYJj8Aeo.
    • Public analyses agree the exploit centered on Nirvana’s ANA buy path rather than on Solend itself. Nirvana explicitly said the flash loan was only the funding rail and that the real bug was an exploit of Nirvana’s own program.
    • Nirvana’s technical postmortem stayed high-level because the protocol was closed source, but it did state the key fact worth preserving: attacker-controlled inputs let ANA be purchased at an artificially low internal price.
    • The treasury account that ultimately paid out the drained stablecoins was CxuuSEv67PzNkMxqCvHeDUr6HKaadoz8NhTfxbQSJnaG.
  • Root cause:
    • Nirvana split one economic promise across two inconsistent boundaries: ANA could be acquired through a manipulable program-side quote path, while the treasury still treated ANA as redeemable against real reserve-backed stablecoins.
    • The attacker did not need to forge ANA or bypass custody directly. They only needed Nirvana’s issuance side to accept distorted pricing inputs for a large buy.
    • Because buying ANA through Nirvana’s AMM also pushed ANA’s displayed protocol price upward, the same transaction that acquired ANA cheaply also improved the mark at which ANA could be monetized.
    • Once the treasury payout side kept honoring ANA against real stablecoins, Nirvana’s own buy/sell loop became an attacker-owned spread.
    • The flash loan amplified a pricing bug that already existed; it was not the core invariant failure.
  • Exploit path:
    1. The attacker opened a Solend flash loan of about 10,250,000 USDC.
    2. They routed that capital into Nirvana’s ANA buy path, using the program-input weakness described in Nirvana’s postmortem to acquire ANA at an artificially low effective price.
    3. That large ANA purchase simultaneously pushed Nirvana’s quoted ANA price from about $8 to about $24, according to public incident analyses.
    4. With ANA now both cheaply acquired and internally marked much higher, the attacker sold or redeemed ANA back into Nirvana’s treasury for stablecoins, pulling out about 13.49M in USDT/USDC aggregate proceeds in public reconstructions.
    5. They repaid the original 10.25M USDC flash loan to Solend.
    6. The remaining roughly $3.5M in profit was converted, then bridged to Ethereum through Wormhole to attacker-controlled address 0xB9AE2624Ab08661F010185d72Dd506E199E67C09.
  • What the attacker needed to be true:
    • Nirvana’s ANA issuance path had to accept attacker-shapeable pricing inputs large enough to make a protocol-scale buy underpriced.
    • Buying ANA had to feed directly into a higher protocol-side ANA quote or other monetizable internal mark rather than merely handing out cheap tokens that could not be sold.
    • The treasury needed to remain willing to honor ANA exits in real stablecoins even after the buy-side price had been distorted.
    • The protocol needed enough treasury reserves on hand that a single transaction could extract meaningful value before operators intervened.
    • The whole loop had to be atomic so ordinary price normalization or monitoring could not interrupt the buy-cheap / sell-expensive sequence.
  • Technical anatomy worth remembering:
    • Nirvana is a useful case where the printed price and the solvency backing sat inside the same protocol-native machine. The attacker did not mainly manipulate an outside DEX and then ask a lending market to trust it; they made Nirvana misquote its own ANA and then let Nirvana’s own treasury honor the resulting fiction.
    • The protocol’s postmortem is careful that this was not an infinite mint bug. The attacker still paid for ANA — just far less than the treasury-side exit path would later honor.
    • That makes the incident a strong preserved example of issuance / redemption asymmetry rather than a pure counterfeit asset story. ANA itself was real; the broken part was the relationship between buy-side cost and treasury-side cash-out value.
    • It is also a protocol-native-collateral cautionary tale: once the reserve collateral was drained, ANA and NIRV lost the external backing their algorithmic design depended on, so damage to users greatly exceeded the attacker’s direct cash profit.
  • Representative transactions and addresses:
    • Main exploit transaction: LyUnvdY9KBQiVRFqmSzGUfCuPGqYX1xNHCWLWxWZ4MvgLcNis2Kui6T25Ayai5UzpTAFkSRSgriKb3pM8tAoeR5
    • Solana attacker account: 76w4SBe2of2wWUsx2FjkkwD29rRznfvEkBa1upSbTAWH
    • Nirvana treasury: CxuuSEv67PzNkMxqCvHeDUr6HKaadoz8NhTfxbQSJnaG
    • Solend main pool vault used in public traces: DdZR6zRFiUt4S5mg7AV1uKB2z1f1WzcNYCaTEEWPAuby
    • Nirvana program: nirkXSE28jCQoK8SmKWqxXz3L9vbSRGKS24iYJj8Aeo
    • Conversion transaction before bridge: 5yF3VH82Wa3TC4zxdzxmEq4jL3EvSPovHVLG3XASzjHNpiyeSt1t2FF6WrHN94hBJc4AAHb3sUWgsAsupSRuszF7
    • Wormhole bridge-out transaction: 0xb5a89c01da58ec7ec8a4b0d0361d8f1719966d4deceaa01efc1362601a76339c
    • Ethereum destination wallet: 0xB9AE2624Ab08661F010185d72Dd506E199E67C09
  • Response / mitigation:
    • Nirvana publicly acknowledged the exploit the same day and emphasized that Solend was only the flash-loan provider, not the vulnerable system.
    • The team later said the exploit had been found and fixed in code, flagged the involved wallets, offered a bounty for fund return, and pursued identification of the attacker through the originating exchange account.
    • Nirvana also warned that without reserve restoration, ANA, NIRV, and related positions could lose most or all economic value because the backing collateral had been removed.
    • In practice, the protocol never recovered as an operating system of note; the exploit functionally ended the design by removing the treasury floor it depended on.

Pattern tags

Why the exploit worked

  • Nirvana let one protocol-authored pricing surface do two jobs that should have stayed more separated: the ANA buy path could be attacker-shaped into undercharging for ANA, and that same internal market state then helped define the richer ANA valuation the treasury-side exit path still honored.
  • The protocol did not keep one reserve-backed claim object intact across external stablecoins entered → ANA quantity issued → ANA mark moved → treasury stablecoins paid back out. The buy side and reserve-paying side consulted different effective notions of truth.
  • Nirvana’s own AMM made the round trip self-reinforcing. The oversized ANA purchase both acquired ANA too cheaply and pushed Nirvana’s displayed ANA price sharply upward, so the protocol’s local mark immediately improved the attacker’s exit terms instead of merely reflecting independent market depth.
  • The treasury treated ANA as if the protocol-authored price move were already good enough reserve authority. There was no stronger consumer-side gate saying this fresh internal mark is manipulable, immature, or too large to spend reserves against at face value.
  • The flash loan mattered because it made the loop atomic and big, but the deeper failure was architectural: Nirvana’s own quote path and treasury payout path composed into an attacker-owned spread.

Detection and audit pivots

  • Reconstruct the exact ANA buy-side inputs the program accepted and ask which of them could be attacker-authored, path-dependent, or size-sensitive. The key question is not only could price move? but could the same call undercharge ANA before that move became treasury-spend authority.
  • Test same-state buy -> sell loops at flash-loan scale. If one oversized ANA purchase can both improve the internal mark and immediately monetize that new mark against reserves, the protocol is already trusting its own freshest local state too much.
  • Separate protocol published a new ANA price from treasury may spend against that price now. Internal AMM state, reserve-ratio updates, or protocol-native marks should age, cap, or clear a stronger realizability check before they become reserve-paying authority.
  • Monitor reserve outflows against attributable value intake rather than against the protocol’s own latest displayed price alone. A reserve-backed system should be able to notice treasury paid far more stablecoins than this ANA position economically should have justified under the same state.
  • Ask what happens if the protocol’s native collateral mark moves violently in one transaction: do redemptions, treasury exits, or related reserve spends narrow automatically, or does the system spend against its own confusion at full size?

Failure-prevention checklist

  • Quarantine protocol-authored ANA marks before they become treasury-spend authority. A freshly updated internal buy quote, reserve-ratio step, or protocol-native price move should not immediately authorize reserve-backed redemptions at full face value.
  • Make issuance and redemption prove the same reserve-backed claim object. If one path computes how much ANA users receive and another path computes how many stablecoins ANA can later withdraw, both surfaces should share one bounded round-trip invariant rather than consult diverging local marks.
  • Cap same-transaction round trips through protocol-native collateral. Buy ANA, move ANA mark, sell ANA back out should hit per-block caps, delayed settlement, or explicit spread controls before reserve inventory becomes the payout source.
  • Treat protocol-native assets as fragile collateral even when the protocol authors the market. Native-token price changes, reserve-ratio changes, and treasury exits should be throttled harder than ordinary external stablecoin accounting because the system is grading its own homework.
  • Monitor reserve spends against economically attributable intake, not just against the latest displayed ANA price. If reserves are leaving much faster than credible external value entered, the protocol should narrow exits automatically.
  • Add flash-loan-scale simulation to treasury-bearing pricing surfaces. If one atomic transaction can push the local ANA mark and monetize that same mark before any slower guard intervenes, the design is not yet safe.
  • Keep a circuit breaker on internal mark moved too far, too fast. Large one-transaction changes in protocol-native pricing, reserve ratios, or treasury liabilities should force a quarantine mode instead of remaining live spend authority.

Audit prompts

  • Which exact inputs on Nirvana’s ANA buy path could shape the effective purchase price, and which of those inputs were ultimately attacker-authorable inside one Solana transaction?
  • When Nirvana paid stablecoins out of treasury, what exact object was it trusting: the fresh ANA mark, a smoothed reserve ratio, a bounded oracle, or only the immediately preceding internal trade state?
  • Can one transaction still both improve a protocol-native collateral mark and cash out against that improved mark before any lag, cap, or realizability check applies?
  • What hard invariant bounds the worst-case same-state round trip from stablecoins in -> ANA issued -> ANA mark rises -> stablecoins out, and is that bound enforced under flash-loan-sized order flow?
  • If ANA’s displayed price triples in one block because of a single buy, what exact rule stops treasury-backed exits from honoring the full move immediately?
  • How does the protocol distinguish internal market state was updated from external backing has genuinely improved enough to spend more reserves?
  • Which monitors compare treasury outflows to external reserve inflows, and how quickly would they detect protocol paid more stablecoins than the manipulated ANA acquisition actually justified?

Lessons that should already be standard

  • A protocol should not spend reserves against its own freshest self-authored mark without a second check. We just moved our own price upward is not yet the same thing as reserves may safely leave.
  • Protocol-native collateral is not safer just because the protocol controls the market. Internal pricing loops often make reflexive assets more dangerous, not less, because issuance, valuation, and redemption can all share the same manipulable state.
  • Reserve-backed designs need one round-trip truth object. If buy-side cost and sell-side payout can disagree inside the same machine, attackers will own the spread long before users realize the backing is gone.
  • Flash loans are usually amplifiers, not root causes. The deeper failure is that the protocol already allowed one atomic state transition to print a richer exit right than the entering value justified.
  • Treasury exits should care about realizability, not only about publication. A freshly published ANA price, reserve ratio, or internal quote should earn reserve authority only after the system proves that the move is economically coherent enough to honor.
  • Direct profit can understate the real blast radius when the drained reserve is the foundation of the whole system. In reserve-backed native-asset designs, a few million of stablecoin loss can invalidate much larger amounts of dependent token value.

Why this incident matters

  • It is a clean example of a protocol-native asset whose own buy path can be manipulated and whose own treasury still pays out, collapsing price discovery, backing, and cash-out into one exploitable loop.
  • It preserves a different failure shape than the more common thin external DEX collateral pump story. Here the critical quote lived inside the protocol, and the treasury was the exit rail.
  • It is also a strong design-side exemplar for internal-mark publication quarantine and reserve-spend separation: Nirvana’s own ANA mark moved first, and the treasury spent against that freshly manipulated local state before any stronger bound proved it deserved reserve authority.
  • It also pairs cleanly with reserve-backed claim truth as a single security object: the protocol never kept ANA acquisition cost, ANA quantity issued, reserve liability, and immediate round-trip boundedness fused tightly enough to stop buy cheap from treasury logic, then sell expensive back into treasury logic.
  • It also shows why direct attacker profit can understate system damage. Nirvana lost about $3.5M of stablecoins, but because ANA and NIRV depended on those reserves as foundational collateral, the effective destruction to holders was much larger.

Internal linkages

Control surface

Graph View

Backlinks