New Gold Protocol Drained by Flash Loan Oracle Manipulation → Security

The image displays a close-up perspective of two interconnected, robust electronic components against a neutral grey background. A prominent translucent blue module, possibly a polymer, houses a brushed metallic block, while an adjacent silver-toned metallic casing features a circular recess and various indentations

A vibrant abstract composition showcases voluminous blue and white smoke-like forms intermingling with multiple transparent, metallic-edged rectangular prisms and a prominent white sphere, all set against a muted grey background. The dynamic interplay of these elements creates a sense of movement and depth, suggesting complex processes within a structured environment

Briefing

The New Gold Protocol (NGP) on Binance Smart Chain suffered a $2 million flash loan exploit, leveraging a critical price oracle manipulation vulnerability. This incident led to an 88% devaluation of the NGP token, demonstrating the severe financial consequences for affected users and the protocol’s ecosystem. The attacker exploited NGP’s getPrice() function, which relied on a single Uniswap V2 liquidity pool, enabling the artificial suppression of the token’s price within a single transaction.

The image displays granular blue and white material flowing through transparent, curved channels, interacting with metallic components and a clear sphere. A mechanical claw-like structure holds a white disc, while a thin rod with a small sphere extends over the white granular substance

Context

Prior to this incident, the DeFi ecosystem has consistently faced risks from oracle manipulation, particularly when protocols depend on single, easily influenceable price feeds. The reliance on spot prices from individual decentralized exchange pools has been a known vulnerability, creating an exploitable attack surface for sophisticated actors employing flash loans. Such architectural weaknesses represent a systemic risk across many nascent DeFi projects.

A high-tech apparatus featuring a dark gray block with blue and gold accents is prominently displayed, intricately connected by multiple flexible, textured conduits and interwoven black cables. The conduits exhibit a distinctive distressed blue circuit-like pattern, emerging from and connecting to the central unit with bright blue bands

Analysis

The New Gold Protocol’s getPrice() smart contract function, designed to determine token value, was the primary system compromised. The attacker initiated the exploit by acquiring a substantial flash loan, which provided the capital to manipulate the NGP/USDT Uniswap V2 liquidity pool. By executing a large swap, the attacker artificially inflated the USDT reserves and simultaneously depleted the NGP token reserves, causing the getPrice() function to report an inaccurate, significantly lower NGP price.

This manipulated price allowed the attacker to bypass the protocol’s transaction limits, acquiring a large quantity of NGP tokens at a heavily discounted rate. Following the acquisition, the attacker reversed the initial swap, repaid the flash loan, and profited from the price differential, subsequently moving the stolen funds through Tornado Cash for anonymization.

A white, glossy sphere with silver metallic accents is encircled by a smooth white ring, set against a dark grey background. Dynamic, translucent blue fluid-like structures surround and interact with the central sphere and ring, suggesting energetic movement

Parameters

Protocol Targeted → New Gold Protocol (NGP)
Attack Vector → Price Oracle Manipulation via Flash Loan
Financial Impact → $2 Million
Blockchain → Binance Smart Chain (BSC)
Vulnerable Function → getPrice()
Price Devaluation → 88% (NGP token)
Fund Laundering → Tornado Cash

A large, textured sphere, resembling a celestial body, partially submerges in dark blue liquid, generating dynamic splashes. Smaller white spheres interact with the fluid

Outlook

In the immediate aftermath, protocols must prioritize the implementation of robust, multi-source oracle solutions to prevent similar price manipulation attacks. Users should exercise extreme caution with DeFi platforms relying on single-point price feeds, understanding the inherent risk of flash loan vulnerabilities. This incident will likely reinforce the industry’s push for more comprehensive smart contract audits that specifically scrutinize oracle dependencies and transaction limit bypasses, establishing new security best practices to mitigate contagion risk across similar protocols.

The image showcases a detailed, abstract representation of interconnected mechanical segments, predominantly white and silver, encasing a luminous blue energy source. This visual metaphor powerfully illustrates the intricate mechanisms and secure protocols that underpin cryptocurrency and blockchain networks

Verdict

This exploit serves as a stark reminder that even seemingly minor architectural flaws, such as single-source oracle dependencies, can be leveraged by sophisticated actors for significant financial gain, underscoring the continuous need for rigorous security posture and diversified risk mitigation in DeFi.

Signal Acquired from → CoinCentral