Briefing
The New Gold Protocol (NGP) on the BNB Chain suffered a sophisticated exploit on September 18, 2025, resulting in the loss of nearly $2 million in digital assets. The incident leveraged a critical vulnerability within NGP’s getPrice() function, which relied on a singular Uniswap V2 liquidity pool for token valuation. This dependency allowed an attacker to execute a flash loan, manipulate the token’s perceived price, and subsequently drain the protocol’s liquidity pool, with stolen funds routed through Tornado Cash to obscure traceability.
Context
Prior to this incident, the DeFi ecosystem has consistently faced risks associated with oracle manipulation and flash loan attacks, particularly in protocols that depend on single-source price feeds. This attack vector exploits the inherent trust placed in external data sources or simplified pricing mechanisms, creating an exploitable surface where temporary market imbalances can be weaponized. The prevailing security posture often underestimates the atomic transaction capabilities of flash loans to exploit such design flaws.
Analysis
The attack initiated with a flash loan, allowing the threat actor to temporarily acquire a substantial volume of tokens without upfront capital. This capital was then used to manipulate the mainPair pool, artificially inflating the USDT reserve while simultaneously depleting NGP tokens. Consequently, NGP’s getPrice() function, relying solely on this manipulated pool, reported a significantly undervalued token price. The attacker then exploited this distorted valuation to bypass the protocol’s transaction limits, purchasing a large quantity of NGP tokens at a deeply discounted, manipulated price, thereby draining the liquidity.
Parameters
- Protocol Targeted ∞ New Gold Protocol (NGP)
- Blockchain Affected ∞ BNB Chain
- Vulnerability Type ∞ Price Oracle Manipulation via Flash Loan
- Exploited Function ∞ getPrice() function’s reliance on single Uniswap V2 pool
- Financial Impact ∞ Approximately $2 Million
- Date of Incident ∞ September 18, 2025
- Funds Destination ∞ Tornado Cash
Outlook
Immediate mitigation for protocols involves implementing robust, multi-source oracle solutions to prevent single points of failure in price discovery. Post-incident, NGP users face potential unrecoverable losses due to funds being routed through Tornado Cash. This event underscores the critical need for comprehensive security audits, particularly focusing on external dependencies and economic attack vectors like flash loans, to establish new security best practices across the DeFi landscape and prevent contagion risk to similar protocols.
Verdict
This incident serves as a stark reminder that even seemingly minor design flaws in price oracle mechanisms can be leveraged by sophisticated flash loan attacks, leading to significant and often irreversible asset drains.
Signal Acquired from ∞ cryptotimes.io