Cowrie Research

venus-protocol-luna-stale-chainlink-price-exploit-2022-05-12

15 min read

Venus Protocol LUNA Stale Chainlink Price Exploit (2022-05-12)

  • Name: Venus Protocol LUNA stale Chainlink price exploit
  • Date: 2022-05-12
  • Protocol: Venus Protocol
  • Chain: BNB Chain
  • Category: oracle manipulation / stale-price exploitation / circuit-breaker freeze / undercollateralized borrow
  • Loss: Venus publicly framed the incident as about $11M of protocol loss; the same disclosures also described about $13.5M borrowed against stale LUNA collateral and an initial shortfall tally of about $14.2M
  • Summary: During the Terra collapse, Chainlink’s BNB Chain LUNA / USD feed hit its minimum-value circuit breaker and stopped updating at about $0.107 around 09:20 UTC on 2022-05-12. Venus kept the LUNA market live for roughly four more hours while real LUNA spot kept collapsing toward $0.01 and below. Attackers accumulated huge amounts of near-worthless LUNA, deposited it into Venus while the protocol still treated it as ten-times-richer collateral, and borrowed out stronger assets before the pause landed at about 15:15 UTC. This was not a classic pump the oracle attack. The exploitable condition was a stale but still-honored price feed: once Venus let a frozen oracle answer remain borrowable collateral truth, cheap crash inventory became real BNB-chain credit.
  • Trigger / entry point:
    • Venus listed LUNA as collateral and borrowing support on BNB Chain and relied on Chainlink’s LUNA / USD feed for solvency-critical pricing.
    • Chainlink’s minimum-value circuit breaker automatically triggered during the Terra death spiral, freezing the feed at about $0.107 instead of following the continued collapse.
    • Venus did not immediately auto-pause or locally quarantine the LUNA market when the feed stopped moving.
    • Venus later said it only became aware of the disparity roughly four hours later, after spotting suspicious accounts depositing very large amounts of LUNA.
  • Root cause:
    • The decisive failure was not that attackers could move the oracle themselves. It was that Venus continued honoring a stale oracle answer after the referenced market had already blown through it.
    • The protocol treated last answer received as equivalent to current realizable collateral value, even during a market regime where the asset was collapsing by orders of magnitude.
    • No per-market freshness or discrepancy guard stopped borrowing when the Chainlink feed stopped responding while external spot continued to move violently.
    • In practice, Venus allowed an oracle safety mechanism built for extreme volatility to become a stale-price borrow primitive.
  • Exploit path:
    1. As LUNA imploded across centralized and decentralized venues, attackers accumulated large amounts of LUNA at prices far below the stale Chainlink mark still used by Venus.
    2. After the Chainlink LUNA / USD feed stopped at about $0.107, attackers deposited that cheap LUNA into Venus as collateral instead of waiting for the protocol to reprice it.
    3. Venus later disclosed that suspicious accounts deposited about 230,000,000 LUNA while the feed was stale.
    4. Because Venus still valued that collateral near the frozen Chainlink price rather than the live crash price, the protocol credited the positions with far more borrowing power than the market could support.
    5. The attackers borrowed about $13.5M of stronger assets against that stale collateral before Venus paused the protocol at about 15:15 UTC using the PauseGuardian multisig path.
    6. By the time the pause landed, Venus said the resulting shortfall across the flagged accounts was about $14.2M on the initial tally.
    7. Attack addresses then swapped and bridged out proceeds; BscScan traces on the disclosed wallets show Venus borrows, PancakeSwap conversions, and bridge exits via routes such as Multichain and Celer.
  • What the attacker needed to be true:
    • LUNA had to remain accepted as collateral while its external market was collapsing faster than the oracle refreshed.
    • The price feed freeze had to preserve a stale answer that was still high enough to create meaningful overvaluation.
    • Venus had to keep borrowing enabled for the affected market instead of failing closed on feed staleness or large external-price discrepancies.
    • The protocol needed enough deep-liquidity assets in sibling markets that stale LUNA collateral could be monetized into stronger reserves.
  • Technical anatomy worth remembering:
    • This is the clean stale-price exploitation cousin inside the oracle-manipulation family: the attacker did not need to print a fake price onchain if the protocol was already honoring a dead one.
    • Chainlink’s circuit breaker was not itself the protocol exploit; the exploit was Venus treating the frozen answer as still money-good collateral without an immediate market-level halt.
    • The critical balance-sheet mismatch was stark: a crash asset with collapsing executable value was still recognized inside Venus at a much older and much higher mark.
    • The incident is also a reminder that oracle outage and oracle manipulation converge economically when stale collateral can still unlock fresh borrowing.
  • Representative transactions and addresses:
    • Venus flagged these suspicious depositors in its incident update: 0x1f6d66ba924ebf554883cf84d482394013ed294b, 0x3b7f525dc67cca55251abb5d04c81a83a6005269, 0x8d655aaaa0ec224b17972df385e25325b9103332
    • Representative Venus borrow / withdrawal tx from flagged address 0x8d655...3332: 0xbfbbfb98c51bf80bd99467dd5856bdb1ba77a7593e9d03a0eba16e6f8b71282b — BscScan surfaces a successful interaction with Venus: vBNB Token that transferred about 642.05573765666948838 BNB internally to the attacker address
    • Representative post-exploit bridge-out tx from flagged address 0x1f6d66...294b: 0x7deed4f843cc5c97f9daae0735e489964b86e45d8912f36e493b8955a22cffd0 — an outbound interaction with Celer Network: cBridge 2.0
    • Representative post-exploit Multichain exit tx from flagged address 0x1f6d66...294b: 0x0ec4b37b81c67b196121cc722232b12ea6613c3f7e5ab79ffc2e931244bcede5
  • Response / mitigation:
    • Venus paused the protocol via PauseGuardian multisig once the stale-feed exploitation was identified.
    • In the staged recovery plan, Venus first set price feeds on all markets to 0 so the protocol could reopen in a narrow supply / repay only posture rather than instantly restoring fresh borrowing and liquidation authority.
    • Venus then restored live feeds for unaffected markets, kept LUNA and UST restricted, set both collateral factors to zero through VIP-61, and only later restored those feeds for a time-bounded exit window before full deprecation.
    • Venus said its Risk Fund, with about $15M in balances, would absorb the shortfall over time and also discussed a backup liquidity loan from the BNB Accelerator Fund if needed.
    • In the remediation writeup, Venus explicitly committed to feed-staleness monitoring, discrepancy alerts, fallback feeds, and per-market fail-safe pauses for future oracle interruptions.

Three collateral-authority promotions this incident collapsed

  1. A Chainlink-shaped collateral answer still existed after the market it described had already broken away from it

    • The BNB Chain LUNA / USD feed did not go blank; it froze at about $0.107 after the minimum-answer circuit breaker fired.
    • That meant Venus still had a syntactically valid oracle artifact to read even though the economic market behind it was already collapsing through that floor.

  2. Venus still promoted that frozen artifact into canonical collateral truth

    • The protocol kept treating the last Chainlink answer as the live value of newly deposited LUNA collateral.
    • This was the decisive promotion: feed still returns a number became new LUNA deposits still deserve ordinary collateral accounting, even while executable spot had fallen toward $0.01.

  3. That published collateral truth still retained live reserve-spending authority

    • Borrowing stayed open long enough for attackers to turn cheap crash inventory into about $13.5M of stronger assets before the pause.
    • Venus’s own restart plan later showed the missing separation clearly: it zeroed feeds across the protocol, reopened in supply / repay only, restored unaffected feeds first, set LUNA and UST collateral factors to zero, and only then reopened a bounded exit path. Pre-incident, those same promotions had still been fused into one state where a frozen answer kept full borrow authority.

Pattern tags

  • stale-price-exploitation
  • oracle-manipulation
  • Chainlink’s own minimum-answer safety stop became downstream borrow authority because Venus kept treating frozen at $0.107 as if it still meant current realizable LUNA collateral value
  • The exploitable gap was not price-printing but degraded-mode policy: once the feed stopped moving during a crash, Venus still left fresh borrowing and deep-reserve withdrawal paths open for hours
  • 230,000,000 LUNA of near-worthless crash inventory could still monetize into BNB-chain credit because collateral admission, oracle freshness, and per-market pause logic were one fused security object

Why the exploit worked

  • Venus’s own incident update already states the critical timing plainly: Chainlink’s BNB Chain LUNA / USD feed suspended at about $0.107 around 09:20 UTC, Venus only recognized the disparity roughly four hours later when spot was around $0.01, and borrowing remained open until the protocol pause around 15:15 UTC. The exploit window therefore was not attacker printed a fake oracle; it was the protocol kept lending against an answer whose economic claim on the market had already expired.
  • Chainlink’s circuit breaker did not save Venus because the safety property stopped at the oracle boundary. Freezing the feed prevented Chainlink from publishing ever-lower numbers below its minimum threshold, but Venus still treated that frozen number as full collateral truth instead of downgrading the LUNA market into a narrower unwind-only or no-new-borrow state.
  • The real balance-sheet mismatch was violent and simple: crash-market LUNA was cheap enough to accumulate in huge size, while Venus still credited that same inventory at roughly ten times the live market price. Once the protocol allowed that stale mark to create borrow power against BNB, stablecoins, and other deeper reserves, the collateral side and reserve side had already parted ways.
  • This makes Venus a particularly clean degraded-mode case inside the stale-price family. The upstream feed was not malicious; it was explicitly no longer updating. The protocol still failed because feed halted did not automatically mean credit extension halted, so the emergency mode preserved the old authority of a number that no longer deserved it.
  • The remediation plan Venus later published also confirms the preserved lesson more sharply than a generic we improved monitoring summary would. Venus’s restart ladder deliberately separated feeds readable at all, markets reopened for supply / repay, unaffected assets regain live feeds, LUNA / UST lose collateral-factor authority, and only later bounded exit access for the deprecated assets. In other words, the exploit path existed because freshness state, operator visibility, and borrow-side permissions were not yet joined tightly enough before the incident.

Detection and audit pivots

  • Treat circuit-breaker or feed-suspension states as degraded-mode solvency events, not only oracle-operator events. If the feed stops moving during extreme volatility, ask immediately which rights stay open: fresh borrowing, collateral entry, liquidations, or only repayments and exits.
  • Compare stale oracle answers to executable spot during stress and size the gap against protocol collateral factors and reserve depth. The useful question is not is the feed honest? but can this frozen mark still create more debt than the collateral could ever support if bought in size right now?
  • Review asset-local pause and quarantine paths for crash collateral. A protocol should be able to set borrow disabled, collateral factor zero, or exit-only faster than bots can source the collapsing asset and route the borrowed reserves out.
  • Ask whether the protocol distinguishes oracle still publishes a number from oracle still demonstrates enough liveness and market relevance for new credit. Venus shows that a feed can remain syntactically usable while semantically dead for lending.
  • Stress-test operational visibility, not just arithmetic. If the team only discovers the stale-price state after suspicious whale deposits, the real monitoring system is already the attacker.

Failure-prevention checklist

  • Treat oracle heartbeat, minimum-answer circuit breakers, and feed-suspension states as market-configuration inputs, not upstream implementation trivia. If a crash asset can move by an order of magnitude inside the stale window, that window is already part of the collateral contract.
  • Predefine a degraded-mode ladder per market: borrow disabled, collateral entry disabled, liquidation paused or narrowed, repay / withdraw still allowed, and collateral factor set to zero should be scriptable without waiting for a full governance cycle.
  • Bind stale-feed handling to reserve depth and collateral-factor math. The question is not only whether the feed is old, but whether the stale mark could still unlock enough borrow power to drain stronger sibling reserves before operators react.
  • Keep independent discrepancy checks against executable venues or secondary feeds so a frozen oracle answer cannot silently keep full credit authority for hours.
  • Separate unwind safely from extend new credit safely. Venus’s later zero feeds on all markets plus repayment-only window is a useful reminder that emergency policy should be able to narrow permissions sharply before reopening ordinary borrowing and liquidation paths.
  • Rehearse crash-collateral offboarding ahead of time: who pauses, who sets feeds to zero, who sets collateral factors to zero, what happens to existing borrowers, and how long the protocol will preserve exit-only access before full deprecation.
  • Monitor for state combinations, not single alerts: feed stopped, spot still moving, large fresh deposits, and deep sibling reserves remain borrowable should be treated as one joined loss event.

Audit prompts

  • If this exact feed hits a minimum-answer floor, heartbeat miss, sequencer halt, or source suspension, what rights remain live on the market one block later?
  • How much borrow power can a user create if they acquire the collateral at executable spot while the protocol still honors the last oracle answer and current collateral factor?
  • Which control fires first when a feed becomes stale during a crash: automatic borrow disablement, guardian pause, collateral-factor haircut, fallback feed activation, or nothing until operators notice?
  • Does the protocol have an explicit repayment / exit-only mode for stale collateral, or is the only choice everything still live versus whole protocol paused?
  • How quickly can operators zero a market’s price feed or collateral factor, and does that path preserve fair unwind for unaffected users without letting attackers keep borrowing against the stale mark?
  • Are discrepancy alerts tied to concrete automatic or guardian actions, or do they only page humans while full credit authority remains open?
  • When the protocol says it has a fallback feed, what exact economic object does that fallback certify during crisis conditions, and for how long may it keep new borrowing open?
  • If suspicious large deposits are the first reliable stale-feed signal, what monitoring surface actually failed before the attacker arrived?

Lessons that should already be standard

  • A frozen oracle answer is not neutral. If the protocol still honors it for borrowing, the protocol has chosen to extend credit against an old market.
  • Oracle circuit breakers do not close lending books for you. Upstream safety stops and downstream credit stops are separate controls and must be designed as such.
  • Feed still returns a number is weaker than this market still has executable collateral truth. Venus failed on that difference.
  • Crash collateral should lose privileges faster than governance normally moves. If the pause path is slower than the market collapse, the stale window is part of the product.
  • Emergency design should preserve unwind asymmetrically: repayments, withdrawals, and offboarding can stay open while fresh borrowing and stale-mark liquidations shut first.
  • Monitoring that only becomes actionable after giant suspicious deposits is not monitoring; it is post-facto exploit detection.
  • Setting collateral factors to zero and staging repayment windows should be preplanned degraded-mode behavior, not improvised after bad debt is already printed.

Why this incident matters

  • Venus preserves an oracle-manipulation branch that differs from Moola, Mango, Cheese Bank, DEUS, Bonq, UwU, and Polter: the attacker did not have to dominate the reference market, only to recognize that the protocol was still lending against an already-invalid number.
  • It is a strong case study in why circuit breaker activated is not automatically safe for downstream integrators. If the downstream protocol does not fail closed, the frozen answer can become the exploit surface.
  • The incident also broadens the corpus beyond bad oracle composition and thin-venue pump stories into the harsher operational lesson that oracle freshness itself is a solvency parameter.
  • It also preserves the narrower design lesson that oracle safety stop and protocol credit stop are separate controls. Chainlink halted its feed; Venus had not yet halted LUNA’s ability to underwrite fresh debt.
  • Just as usefully, Venus’s own recovery sequence became a compact positive-design template for future stale-feed incidents: zero the feed or equivalent borrow authority first, reopen for repayments and exits, reduce collateral factors or offboard the asset, and only then consider any narrower restoration of market function.

Internal linkages

Control surface

  • The decisive leverage sat in LUNA collateral admission, oracle freshness monitoring, fail-closed pause policy, and Venus’s willingness to keep honoring a frozen Chainlink answer as borrowable collateral truth.
  • Venus did not merely have oracle trouble. It let a dead price keep underwriting live credit.
  • The sharper operating failure was degraded-mode design: feed suspended, market still borrowable, and pause only after suspicious deposits were allowed to coexist long enough for cheap crash inventory to become deep-reserve outflow.

Sources

Last reviewed

  • 2026-08-03 UTC

Graph View

Backlinks