MANGO MARKETS EXCHANGE

An arrest of Avraham Eisenberg took place recently, he is the guy behind the trading strategy that attacked the Mango markets exchange. Unlike in the case of FTX, the illegality of the attack is not very clear. The mango market is a decentralized feature exchange built on Solana. It allows users to trade derivatives instruments like perpetual features which are tiled to the spot performances of some other cryptocurrencies. It is governed not by a centralized liquidation or deleveraging engine but subcontract that is built on Solana.

---

As is with the case of most centralized applications, governance decisions about the protocol through a DAO. On the 11th of October last year, the exchange platform was hit with the oracle manipulation attack. He figured out a way to take advantage of the price update by the oracle after placing a $5 million trade. The Oracle fed the mango market protocol a price update which makes the account viewed as having a lot of collaboration worth $190 million. This collateral could be used to take out loans from the protocol and that is exactly what the attacker did.

---

He borrowed $110 million in several different tokens. This fund was then sent to the attack's wallet with the intention of not returning them. This drained the Mango lending pool and when the token was safely withdrawn from the Mango pool, the attack sold it on centralized exchanges back to USDC. This led to the price of mango collapsing making the account on the mango market that was profitable to be less profitable. Attackers drain funds from the Mango market, and funds from other users. Oracle manipulation is actually common in Defi, and the past has been carried out in Ethereum protocols with flash loans which are why oracles need to have good pricing data.

---

After the attack, program instructions were frozen to prevent further access to the protocol, this included deposit and withdrawal but it was too late. The users didn't have to wait too long to find out who the attacker was. It was not because the authority was after him but because he bragged about it on Twitter. But the attacker did show some rumors about the attack, he said he felt sorry that his exploit had drained the protocol. He was beginning to negotiate with the DAO in other to return some of the funds. After the DAO votes, an agreement was finally reached which will see 67 million dollars in return, and part of the agreement was that they would not come after him. Even though the users had agreed to come after him, the US Department of Justice didn't want that idea. It was announced in December that he has been arrested in Puerto Rico.

Reference
Reference