Cowrie Research

mango-markets-mngo-oracle-manipulation-2022-10-11

14 min read

Mango Markets MNGO Oracle Manipulation (2022-10-11)

  • Name: Mango Markets MNGO oracle manipulation
  • Date: 2022-10-11
  • Protocol: Mango Markets
  • Chain: Solana
  • Category: oracle manipulation / cross-market self-dealing / thin-liquidity collateral inflation / bad-debt extraction
  • Loss: roughly 117M drained from the protocol; the attacker later returned about 47M under the later settlement path described by regulators
  • Summary: The attacker funded two Mango accounts with roughly 0.0382 to roughly $0.499. The CFTC later described the oracle-reported MNGO price as jumping more than 13x in about 30 minutes. That turned the long-side account into a fake giant winner on paper. Mango let that paper profit turn into borrow power, and the attacker withdrew real assets — SOL, mSOL, USDC, USDT, BTC wrappers, and more — before the mark collapsed and left the protocol with bad debt.
  • Trigger / entry point:
    • Mango used oracle-driven MNGO prices to value MNGO-PERP positions and therefore account health.
    • The referenced MNGO spot markets were too thin relative to the size of positions Mango allowed.
    • Mango let the manipulated long-side account settle PnL and borrow against that newly inflated account value fast enough for the attacker to remove real assets before mean reversion.
  • Root cause:
    • Mango’s risk engine treated oracle-priced MNGO exposure and resulting perpetual PnL as if it reflected realizable economic value.
    • The protocol let a thin governance token and a perp market built on that token create large, fast-moving collateral value against much deeper reserve assets.
    • The real failure was not just bad price data; it was a solvency design that allowed cheaply manipulated mark-to-market gains to become immediately withdrawable borrowing capacity.
  • Exploit path:
    1. The attacker funded two Solana accounts from FTX-linked flows and created two Mango accounts.
    2. Each Mango account deposited about $5M USDC as collateral.
    3. One Mango account opened a giant long in MNGO-PERP; the other opened giant short positions, effectively putting the attacker on both sides of the perp market.
    4. The attacker then bought MNGO aggressively on the spot venues feeding Mango’s oracle, including Serum-linked flow, pushing the spot reference price from about 0.499.
    5. Mango marked the long position up massively and allowed SettlePnl, transferring huge apparent profit into the long-side account’s borrow capacity.
    6. Using that inflated account equity, the attacker borrowed and withdrew protocol assets including wrapped SOL, mSOL, USDC, USDT, and wrapped BTC.
    7. Once the price normalized, the long account was insolvent and Mango was left with large bad debt while the attacker held the drained assets off-platform.
  • What the attacker needed to be true:
    • MNGO spot liquidity on oracle venues had to be shallow enough that a few million dollars of aggressive flow could move the reference price dramatically.
    • Mango had to let MNGO-linked perp gains count as economically meaningful collateral quickly enough to withdraw real assets before reversion.
    • Position sizing, borrow caps, and risk limits had to be loose relative to the true executable depth of MNGO.
    • The protocol had to hold enough high-quality assets in its pools for the fake collateral to be worth attacking.
  • Technical anatomy worth remembering:
    • This was not a reentrancy bug or a signature-forgery bug. The contracts largely behaved as designed; the design itself let a manipulable market print solvency.
    • The attacker did not need organic counterparties for the core trade thesis. Using two controlled accounts to take opposite perp sides meant the attacker mainly needed the oracle mark to move, not a genuine market consensus to emerge.
    • The critical bridge from market manipulation to theft was SettlePnl plus borrow logic. Paper gains became balance-sheet credit.
    • The protocol’s own governance token sat too close to the solvency core. Mango effectively allowed a thin internal risk asset to unlock withdrawals of stronger external assets.
    • The post-exploit governance episode mattered too: the attacker did not just negotiate from an offchain bargaining position. Mango’s own proposal text asked tokenholders to use DAO treasury and insurance resources to cover the remaining bad debt, waive potential claims against accounts with bad debt, and avoid criminal investigations or fund freezes once assets were partially returned. In practice, the same exploit that printed fake MNGO-linked solvency also bought leverage over the cleanup path.
  • Representative transactions and accounts:
    • Attacker account 1: yUJw9a2PyoqKkH47i4yEGf4WXomSHMiK7Lp29Xs2NqM
    • Attacker account 2: J44uRJxJEDTyPgFG6BtQJ3skhex8FeBbDJWVoh3z9dJU
    • Main long-side Mango account: 4ND8FVPjUGGjx9VuGFuJefDWpg3THb58c277hbVRnjNa
    • Main short-side Mango account: CQvKSNnYtPTZfQRQ5jkHq8q2swJyRsdQLcFcj3EmKFfX
    • Deposit 5M USDC to MangoAccount1: 3cBEK257espSw2X6Z7ZZESPPdcsfBoNLYJGAmXEExxw1QpjkSJfcd9kmtER7LkZ3RGbeXKHv1FR4hRBCD5wA8unY
    • Open giant MNGO-PERP long: 2xPS2ZefQ3QvvMpQ1FLLTdAwWARZ424BH4VZXJke2TeRYJ34Frt8FwD7sE6paGUHXSRv3o1M8VSfGBGANAmXHPQR
    • Deposit 5M USDC to MangoAccount2: 66AFLig3vs5XkksTZRh5BPo2iiiPV7jHL3hhjwMe3mRyqC9FG8ELgx3HPCWs8QQy1iSi9BAzm6Wx24fHcTtC1xyC
    • Open major short legs: 2mMMvCQAxx6MZzEmVceRHmwbWv8wmnT8rhSqTiuD13sXWxyEgSsxjTxnBU4a8Lspp3Gfz6DaDErvRnVMCwp4hf4x, qbVq5Vd2fxZywoN6mSBJP5qKSX138jMq7PVb1AtiVcNLoghNGmHe1ceVgpeoHWJuTbqPpp2VYG3TafYbG2wM4yE, 2q2k8qtF9DSDQGxZ4R5QZAd8B3fzBY14fnWNwm8LwHXp3GXEPKJ26mSVAwmvfSUcGz71tNtjo62PHomAwGsd5g45
    • Early spot-pump trade: 5o2wku1u3FYwjbAvVuCyWcN6rknLZSs4wjfA1ocuoVMWnqcRkuDMuU8RzZWh6DkDnZ5fKrVw2k4HK9zWiv1HE1Km
    • Key SettlePnl transaction: SFVdKJpzm2hsK5Kq9LDBD47ZXQu85s5UffCYUrzsqZUBiWrCm1q7JG95PpRye42fqnZyAXeAvYPKxiV6urcEDv1
    • Peak price-push trade to roughly $0.499: 3SZpH1FNCVXk5J19fMHjfHmAhht9korcxkBK2RmtQk47ykmJiKFqTbAfHxcWLpaE7kam4qFT6N8LQMT3yu6Bs5XX
    • Example withdrawal transactions: 2J46z4LPo614eWeQpjZE6UvDhmHEYmBEayq6nXoekSATfFbHpmSBMBcZZ1qZLAQeFu1KDNy8ktSXSzVZXBKspgwY, zpoYV6qp1YTviEZSPZijAsXUDZy5RTsMbCtAdrab1ZeEnovRobYxa2Eb3cbaS6LnYXQerYdMLfZrNKPsNrvWnqV, 281HwRCNUxaxyG61TKKGyZSqUdEPvuysBkYCJBu1qtveYsFvTyGb4sxrJ8MSzRBMPVs8Su5YemAenKFjqwNcXdRF

Three solvency-and-governance promotions this incident collapsed

  1. A thin MNGO quote was still easy to print on Mango’s oracle-input venues

    • The attacker only needed to ram enough size through the small set of markets feeding Mango’s oracle to move the reported MNGO price from about $0.0382 to about $0.499 over a short window.
    • That proved only that a local quote could be authored. It did not yet prove that MNGO had gained durable executable depth or that the resulting perp marks described realizable balance-sheet strength.

  2. Mango promoted that printed quote into canonical account-equity truth through perp marking and SettlePnl

    • Mango marked the attacker’s long MNGO-PERP position up against the pumped oracle price and then let SettlePnl transfer that paper gain into account equity as if the protocol had already observed one money-good economic win.
    • This was the decisive false promotion: attacker-shaped spot prints stopped being merely a thin market moved and became Mango's official answer for how much collateral value and borrow power this account now owns.

  3. That published equity still retained live reserve-spend authority and later cleanup leverage

    • Once the long-side account’s equity had been inflated, Mango still let it borrow and withdraw deep-liquidity assets — SOL, mSOL, USDC, USDT, wrapped BTC, and more — before the mark collapsed.
    • The same incident then spilled into governance because retained MNGO inventory still mattered during the later partial return / treasury-cover / waive-claims settlement process. In practice, the protocol let one attacker-authored local quote become not only reserve-spend authority, but also bargaining leverage over the constitutional cleanup path.
  • Response / mitigation:
    • Mango wound up with large bad debt and entered a chaotic governance and settlement process rather than a clean technical unwind.
    • The settlement proposal itself is worth preserving because it made the extortion structure explicit. The published text asked the wallet controlling yUJw... to return specified assets to the Mango Upgrade Council, send back non-USDC / non-mSOL / non-MNGO / non-SOL assets within 12 hours of the proposal opening as good faith, and return the remaining assets within 12 hours after the vote passed.
    • In exchange, the proposal asked Mango tokenholders to use treasury and insurance resources to cover remaining bad debt, waive potential claims against accounts with bad debt, and not pursue any criminal investigations or freezing of funds once the tokens are sent back.
    • Regulators later described the outcome as about 47M retained.
    • The incident became a live example that the code allowed it is not a sufficient defense when a protocol’s solvency depends on manipulable markets.

Pattern tags

  • oracle-manipulation
  • protocol-native-collateral-fragility
  • The attacker did not need organic counterparties or durable MNGO demand; two controlled Mango accounts took opposite perp sides, printed the oracle inputs, and let SettlePnl harden paper gains into real reserve authority
  • Thin governance-token price discovery and derivatives settlement sat too close together: Mango treated attacker-shaped MNGO spot moves as if they were realizable MNGO-PERP equity and then as borrowable balance-sheet strength
  • The exploit spilled past solvency into constitutional leverage because retained MNGO voting power shaped the later partial return / treasury backstop / no-claims settlement path

Why the exploit worked

  • The attacker did not need to prove that MNGO had durable fair value. They only needed to push the three oracle-input venues long enough for Mango to mark the long-side account up, settle the resulting PnL, and let that account withdraw stronger reserve assets before the mark collapsed. The decisive bridge was not the spot pump alone; it was Mango’s willingness to treat freshly printed perp profit as money-good collateral.
  • Using two controlled accounts on opposite sides of MNGO-PERP meant the attacker mostly controlled the derivatives inventory they needed. Once Mango let SettlePnl transfer the winning side’s paper gains into account equity, the protocol itself converted attacker-shaped cross-market state into borrow authority.
  • MNGO’s role as Mango’s own thin governance token made the solvency side much worse. The protocol was effectively lending deep-liquidity assets against a house asset whose quoted value was local, reflexive, and far less executable than the reserves it unlocked.
  • The post-exploit governance episode shows the constitutional sequel clearly. The proposal text did not merely ask for a pragmatic partial return; it bundled a timed return schedule, treasury/insurance bad-debt coverage, claims waiver for bad-debt accounts, and a commitment not to pursue criminal investigations or fund freezes once tokens were returned. The same incident therefore created both the hole and the constitutional instrument used to legitimize part of the outcome.
  • This means the sharp lesson is broader than oracle bad: Mango joined oracle venue choice, protocol-native collateral policy, perp-PnL settlement, and governance-token constitutional power into one manipulable security object.

Detection and audit pivots

  • Ask exactly what state transition turns unrealized or freshly settled perp PnL into withdrawable equity. If a thin-market mark can become reserve-spend authority in the same episode, the venue is over-trusting its own balance-sheet math.
  • Stress the two controlled accounts on both sides path explicitly. A derivatives venue should not assume that large offsetting open interest implies genuine market consensus if one actor can own both inventories and only needs the oracle mark to move.
  • Treat protocol-native and governance-token perps as a separate solvency bucket. If the underlying spot market is local and thin, mark-to-market gains should face stronger haircuts, settlement delays, and reserve-outflow caps than blue-chip markets.
  • Review whether oracle venues are economically independent from the protocol’s own liquidity story. Mango’s quoted MNGO price came from markets shallow enough that a few million dollars of flow could author the solvency mark for a much larger reserve withdrawal.
  • Simulate the full path pump house token -> settle perp PnL -> borrow deep reserves -> use retained governance inventory to shape cleanup. Mango is a reminder that house-token incidents can mutate from pure oracle loss into governance leverage over incident response.

Failure-prevention checklist

  • Treat protocol-native perp markets as a separate solvency class. A thin governance-token mark should not inherit the same SettlePnl, borrowing, and withdrawal semantics as BTC, ETH, SOL, or stablecoin markets.
  • Size MNGO-like house-asset risk from executable exit depth, not quoted market cap or local trading volume. If the venue cannot liquidate size near the mark, the mark should not underwrite deep-reserve withdrawals.
  • Put hard caps and time delays between fresh perp PnL and reserve-spend authority. SettlePnl should not let a briefly printed oracle mark become same-episode borrow power against the deepest assets on the platform.
  • Stress the two controlled accounts on both sides path explicitly in risk reviews. A perp venue must assume large offsetting open interest can be one actor monetizing oracle movement rather than genuine market consensus.
  • Keep protocol-native collateral, protocol-native perp PnL, and governance-token credit in one risk lane. If the same house asset can move collateral policy, print account equity, and influence cleanup governance, those are not separate controls.
  • Cap reserve outflows attributable to thin house-asset repricing so one successful local pump cannot evacuate unrelated SOL, BTC, ETH, or stablecoin reserves in a single window.
  • Add event-aware emergency modes for house-asset dislocations: lower caps, widen haircuts, freeze fresh borrowing, and throttle large withdrawals before governance debates begin.
  • Pre-plan the constitutional response. If an attacker can retain enough governance inventory to influence settlement, the protocol needs a crisis path that does not treat fresh exploit-funded voting power as ordinary cleanup legitimacy.

Audit prompts

  • What exact transition turns unrealized or freshly settled perp PnL into withdrawable equity, and how quickly can that state unlock stronger reserve assets?
  • If one actor owns both sides of the dominant perp inventory, does the venue still infer genuine market price discovery from the resulting open interest and mark-to-market changes?
  • How much capital does it cost to move the oracle venues backing the house asset by the amount needed to unlock the protocol’s deepest reserves?
  • Which assets can be borrowed out once the house-token mark rises, and what hard caps or withdrawal throttles keep that repricing from draining unrelated reserve pools?
  • Are protocol-native spot collateral, protocol-native perp PnL, and governance-token voting power reviewed as one joined security object, or in separate silos that each assume the others stay conservative?
  • During a sharp house-asset repricing, what is the first action the protocol takes: freeze borrowing, delay settlement, widen haircuts, cap outflows, or merely watch the oracle keep updating?
  • If the printed mark collapses immediately after settlement, what executable liquidation depth exists for the resulting collateral or deficit, and who actually absorbs the unwind?
  • Could exploit-funded governance inventory influence waiver, treasury-backstop, pause, or settlement decisions before the protocol has neutralized the solvency hole?

Lessons that should already be standard

  • A perp mark on a thin governance token is not safer than spot collateral just because the exposure is expressed as PnL. If the mark is cheap to print, the PnL is cheap to fake.
  • Oracle manipulation was only the first half of Mango. The decisive design error was letting fresh house-token paper gains harden into reserve-spend authority against much stronger assets.
  • Two-sided self-dealing matters more than open-interest optics. A large perp market can still be one attacker talking to themselves while the protocol mistakes that inventory for real market consensus.
  • House-token incidents are often constitutional incidents too. If the exploited asset also carries governance power, the attacker may gain leverage over the post-exploit settlement and loss socialization path.
  • Local price discovery is not enough for solvency. The protocol must ask who actually buys size on the way down before it lets that mark underwrite stablecoins, BTC wrappers, SOL, or treasury assets.
  • PnL settlement rules are collateral policy. Any path that turns mark-to-market gains into withdrawable equity belongs in the same risk review as collateral factors, borrow caps, and oracle design.

Why this incident matters

  • It is one of the clearest modern examples of cross-market oracle manipulation where the exploit path is mostly balance-sheet design, not contract-call trickery.
  • It shows how dangerous it is to let thin governance-token prices drive borrow power against deep-liquidity reserve assets.
  • It also shows that derivatives PnL can be just as dangerous as spot collateral when the mark itself is easy to print.
  • The aftermath preserves a second lesson beyond oracle design: if the exploited asset is also the governance token, an attacker can spill from solvency manipulation into constitutional leverage over the settlement itself.

Internal linkages

Control surface

  • The leverage sat in oracle venue selection, collateral policy for MNGO exposure, MNGO-PERP risk parameters, SettlePnl crediting rules, and the absence of depth-aware caps between quoted price and borrowable value.
  • Mango did not merely have an oracle problem. It had a joined solvency-and-governance problem: the protocol treated a briefly manipulable governance-token mark as money-good collateral against the rest of the balance sheet, then let the same house token shape the settlement politics afterward.

Sources

Last reviewed

  • 2026-08-03 UTC

Graph View

Backlinks