Mango markets on Solana was just drained for over $100M.

Mango markets is a Decentralised, cross-margin trading app that allows up to 20x leverage with lightning speed and near-zero fees. It appears the attacker was able to manipulate their Mango collateral. They temporarily spiked up their collateral value, and then took out massive loans from the Mango treasury.

Statement made by Mango Markets Twitter page:

“We are currently investigating an incident where a hacker was able to drain funds from Mango via an oracle price manipulation. We are taking steps to have third parties freeze funds in flight.”

List of stolen funds and amount stolen

USDC: -53,792,050.73

MSOL: -768,538.390

SOL: -761,594.867

BTC: -281.125

USDT: -3,266,494.74

SRM: -2,354,359.10

MNGO -32,409,595.68

EDIT 1: Here is a very logical guess at how the hacker was able to pull this off by Joshua Lim from twitter. Brought to my attention by u/psilodelic thank you brotha!

At 6:19 PM ET, attacker funded acct A (CQvKS...) with 5mm USDC collateral attacker then offered out 483mm units of MNGO perps on the order book.

At 6:24 PM ET, attacker funded acct B (4ND8F...) with 5mm USDC collateral to buy those 483mm units of MNGO perps, at a price of $0.0382 per unit.

At 6:26 PM ET, attacker started to move the price of MNGO spot mkt, it traded as high as $0.91 at MNGO/USD price of $0.91 per unit.

Account B was in the money by 483mm * ($0.91 - $0.03298) = $423mm, That was enough unrealized P&L to take out a loan of $116mm across a bunch of tokens, which then left mango and leaves the protocol at a deficit.

It looks like that effectively wiped out all available liquidity on mango of course, after the attack MNGO/USD traded down to $0.02, which means acct A is now ITM on its short MNGO perp position to the tune of $12mm

But there is literally no liquidity left to pay acct A out, so attacker will have to be satisfied with the $116mm he took from acct B

EDIT 2: according to a post on Twitter the hacker has spoken and proposed the following:

Repay bad debt Voting

“Hi all, the mango treasury has about 70M USDC available to repay bad debt. I propose the following. If this proposal passes, I will send the MSOL, SOL, and MNGO in this account to an address announced by the mango team.

The mango treasury will be used to cover any remaining bad debt in the protocol, and all users without bad debt will be made whole. Any bad debt will be viewed as a bug bounty / insurance, paid out of the mango insurance fund.

By voting for this proposal, mango token holders agree to pay this bounty and pay off the bad debt with the treasury, and waive any potential claims against accounts with bad debt, and will not pursue any criminal investigations or freezing of funds once the tokens are sent back as described above.”