Injective Exploited For $4.9M Via Market ID Collision In Binary Options Settlement Logic
Injective, a Layer 1 blockchain protocol specializing in decentralized finance, was focused in an exploit on August 31 that drained roughly $4.9 million by way of a crucial vulnerability in its binary choices settlement system.
The attacker systematically abused a permissionless market-creation mechanism to launch 299 prompt binary choices markets over a 19-hour interval, every administered by way of a self-controlled oracle intentionally configured to by no means present costs. Oracle symbols have been explicitly constructed to set off the no-price refund path, with expiration and settlement timestamps set mere seconds aside.
On-chain evaluation reveals the exploit relied on self-matched trades throughout the attacker’s personal subaccounts. The actor deposited collateral, assumed each lengthy and brief positions at manipulated costs, and exploited the refund mechanism to extract roughly twice the deposited quantity per cycle.
In one documented sequence, roughly 105,000 USDC generated withdrawals exceeding 204,000 USDC. The proceeds have been subsequently bridged to Ethereum by way of CCTP, swapped for ETH on Uniswap, and consolidated in handle 0x5a18…69ea, the place roughly 1,980 ETH—roughly $4.88 million—remained unmoved at press time.
The Injective chain halted for roughly three hours and 42 minutes, from block 181,027,006 at 16:10 UTC to dam 181,027,007 at 19:52 UTC. Unlike Cronos, which rolled again transactions following a latest incident, Injective superior by precisely one block throughout the seam, preserving all executed trades. The ultimate exploit try failed solely as a result of its settlement timestamp expired amid severely slowed block manufacturing, which had dropped to roughly 38-minute intervals instantly earlier than validators intervened.
Technical Flaw and Transparency Criticism
The root trigger traces to a market identifier collision in Injective’s core logic. The protocol generates market_id by concatenating oracleType, ticker, quoteDenom, oracleSymbol, and oracleProvider with out separators or size prefixes. This hashing scheme allowed the attacker to create an INJ-denominated insurance coverage fund that collided with the identifier of a USDC-denominated binary choices market.
When settlement entered the no-price refund path, the system tried to cowl the manufactured USDC deficit utilizing the uncooked integer stability of the connected INJ fund. Because the code handled minimal INJ balances as enough protection for the dollar-denominated shortfall, it bypassed the required haircut amongst remaining positions and permitted full withdrawals of artificially inflated balances.
The incident has renewed scrutiny of Injective’s choice to take away its core chain repositories from GitHub, a transfer beforehand justified as decreasing assault floor.
Critics contend the exploit demonstrates the elemental limits of safety by way of obscurity: the attacker relied solely on public SDK documentation, legacy compiled binaries as much as model 1.17.2, and the reside Frontrunner testnet to empirically reverse-engineer the vulnerability. Meanwhile, unbiased auditors and whitehat researchers have been denied the source-level entry essential to establish the flaw proactively.
Communication failures compounded the technical breach. Throughout the halt, Injective’s official social media channels printed advertising content material selling new merchandise, with out acknowledging the incident or reassuring customers. This strategy contrasted sharply with protocols like MANTRA and Cronos, which publicly disclosed latest outages.
An on-chain message providing a bounty was despatched to the attacker from an unverified good pockets, although Injective has not confirmed official involvement, and the sender’s identification stays ambiguous. At the time of writing, the protocol had issued no public assertion relating to the exploit, its influence on customers, or deliberate remediation measures.
The put up Injective Exploited For $4.9M Via Market ID Collision In Binary Options Settlement Logic appeared first on Metaverse Post.
