Image credit: Unsplash
Ostium has paused all trading after security firms reported an apparent oracle exploit affecting the decentralized exchange’s liquidity vault.
Blockaid estimated losses at about $18 million, while CertiK placed the figure near $22 million. Ostium has not confirmed the attack method or final loss and said its investigation remains active.
Ostium Tells Users to Revoke Approvals
Ostium identified an issue affecting its Ostium Liquidity Provider vault on July 15 and suspended trading across the protocol. It later advised users to temporarily revoke approvals granted to its smart contracts while the team investigates.
The OLP vault contains USDC deposited by liquidity providers and supports settlement across the exchange. Ostium offers perpetual contracts linked to stocks, exchange-traded funds, commodities, indices, currencies and crypto assets on Arbitrum.
OLP Vault Supports USDC Trade Settlement
Ostium’s documentation says trades settle on-chain in USDC through its liquidity pool infrastructure.
The platform supports dozens of trading pairs and leverage of up to 200 times on selected markets.
That liquidity structure made the OLP vault the focus of the reported exploit, because withdrawn funds came from the pool used to support trading and settlement.
Future-Dated Reports Allegedly Created False Profits
Blockaid said the attacker used a registered PriceUpKeep forwarder and future-dated oracle reports that the protocol treated as authorized. The manipulated data allegedly allowed the attacker to open or settle trades at false prices and withdraw artificial profits from the liquidity vault.
Ostium relies on offchain infrastructure to fetch market prices and trigger automated actions such as liquidations, limit orders and stop-loss transactions. Its documentation names Stork infrastructure for real-world asset feeds, Chainlink for crypto prices and Gelato for automated keeper functions.
Ostium Has Not Confirmed the Exploit Method
The reported attack appears to involve trusted oracle or signer infrastructure rather than a confirmed flaw in the exchange’s core trading contracts. Ostium has not endorsed that conclusion.
Security estimates differ because researchers tracked separate transactions and measured the vault’s losses at different points. One analysis said the attacker converted withdrawn USDC into Ether and distributed the assets across several wallets, but Ostium has not issued a final accounting.
Trading Remains Frozen During Review
The protocol must now determine the confirmed loss, identify which liquidity providers were affected and decide whether compensation or asset recovery measures are required.
Trading remains paused while Ostium reviews whether its oracle and authorization systems can safely resume operation.
