Mango Markets Hack: $114M From One-Token Oracle Manipulation

The Bug in One Sentence

Mango Markets let a trader borrow against unrealized PnL priced off a spot oracle for a token whose entire order book was thinner than the position being marked.

That is the whole exploit. Everything else is plumbing.

How Avi Drained $114M With ~$10M

On October 11, 2022, Avi Eisenberg funded two Mango accounts with roughly $5M USDC each. From one account he opened a massive long on MNGO-PERP. From the other, he took the opposite short. Net exposure to MNGO: zero. Net capital at risk: just the margin.

Then he went to the spot markets — AscendEX, FTX, and Mango's own spot book — and bought MNGO. MNGO was a governance token with a fully-diluted valuation barely north of $70M and daily volume in the low six figures. His buys pushed the price from $0.038 to roughly $0.54 in under ten minutes. A ~1,300% pump.

Mango's oracle, which aggregated spot prices, dutifully marked his long position up. Suddenly his PnL was hundreds of millions of dollars. Mango's risk engine counted that PnL as collateral. He borrowed every USDC, BTC, SOL, mSOL, USDT, and SRB in the protocol — $114M — and walked.

Then he posted on Twitter that it was a 'highly profitable trading strategy,' returned about $67M as part of a governance-coerced 'bug bounty' deal, and kept the rest. The DOJ later disagreed with his characterization. He was convicted in April 2024.

The Solidity Equivalent

Mango lives on Solana, but the bug is protocol-agnostic. Here is the same mistake in Solidity — a lending pool that accepts a long-tail token as collateral and reads its price from a single DEX pool:

```solidity
// VULNERABLE
contract LendingPool {
IUniswapV2Pair public mngoEthPair;
IERC20 public mngo;
IERC20 public weth;

function collateralValueUSD(address user) public view returns (uint256) {
uint256 bal = userCollateral[user];
(uint112 r0, uint112 r1,) = mngoEthPair.getReserves();
// spot price from a single thin pool
uint256 priceInEth = (uint256(r1) * 1e18) / uint256(r0);
return (bal * priceInEth * ethUsdPrice()) / 1e36;
}

function borrow(uint256 amount) external {
require(collateralValueUSD(msg.sender) >= amount * 100 / 80, "undercollateralized");
debt[msg.sender] += amount;
USDC.transfer(msg.sender, amount);
}
}
```

An attacker flash-loans WETH, swaps it into the pair to spike `r1/r0`, calls `borrow()` in the same transaction, then unwinds the swap. They walk with the protocol's USDC. This is the Cream, Harvest, bZx, and Mango pattern in one contract.

The Fix

Three things have to be true simultaneously, not any one of them in isolation.

**1. Manipulation-resistant pricing.** Use a Chainlink feed with deep market depth across centralized venues, or a long-window TWAP with a fallback. Spot from one AMM pool is never acceptable for collateral pricing.

**2. Borrow caps and isolated collateral factors.** A token with $200K of daily volume should not back $100M of borrows, full stop. Set per-asset supply caps that are a small fraction of liquid float.

**3. PnL haircuts on perps.** Unrealized PnL should not be 100% fungible with cash collateral, especially for illiquid underlyings. Mango's biggest sin was treating mark-to-market gains on MNGO-PERP as if they were USDC.

```solidity
// FIXED
contract LendingPool {
AggregatorV3Interface public mngoUsdFeed; // Chainlink, deep-market-aware
uint256 public constant SUPPLY_CAP = 500_000e18;
uint256 public constant COLLATERAL_FACTOR_BPS = 2000; // 20%, not 80%
uint256 public totalCollateral;

function deposit(uint256 amount) external {
require(totalCollateral + amount <= SUPPLY_CAP, "cap");
totalCollateral += amount;
userCollateral[msg.sender] += amount;
mngo.transferFrom(msg.sender, address(this), amount);
}

function collateralValueUSD(address user) public view returns (uint256) {
(, int256 price,, uint256 updatedAt,) = mngoUsdFeed.latestRoundData();
require(price > 0 && block.timestamp - updatedAt < 1 hours, "stale");
uint256 raw = (userCollateral[user] * uint256(price)) / 1e8;
return (raw * COLLATERAL_FACTOR_BPS) / 10_000;
}
}
```

Notice the collateral factor dropped from 80% to 20%. For thin tokens, that is still arguably aggressive. Aave's listings of long-tail assets sit at 0% LTV — usable as a borrowable asset, not as collateral. That is the conservative default.

Why TWAPs Alone Don't Save You

A 30-minute Uniswap V3 TWAP is harder to manipulate than spot, but not impossible — Inverse Finance lost $15.6M in April 2022 to a TWAP manipulation on a Curve pool. Manipulation cost scales with liquidity and time window, not with the existence of a TWAP. If a token's pool depth is small relative to your protocol's exposure, no oracle architecture rescues you. The risk parameters do.

We walk teams through this exact threat model in our [free AI audit](https://www.cryptohawking.com/audit) — collateral asset listings are one of the first things it flags.

The Broader Pattern

Every oracle-manipulation hack reads the same:

Harvest Finance (Oct 2020): $34M, Curve spot price.
- bZx (Feb 2020, twice): $1M combined, Uniswap V1 spot.
- Cream Finance (Oct 2021): $130M, yUSD share-price oracle.
- Mango (Oct 2022): $114M, thin-token spot.
- Inverse Finance (Apr 2022): $15.6M, Curve TWAP.

The through-line: the protocol trusted a price source whose cost-to-manipulate was less than the size of the position being priced. Pricing is an economic problem before it is a code problem.

If you are about to list a new collateral asset, the question is not 'what oracle.' The question is: what does it cost an attacker to move the oracle by X%, and is X% × my exposure greater than that cost? If yes, you have a Mango on your roadmap.

For any protocol holding more than ~$10M TVL, that question deserves more than a Discord vibe check. Our [$5,000 manual audit](https://www.cryptohawking.com/audit/manual) — paid in ETH, SOL, or USDT, three business days — stress-tests every oracle path and collateral listing against this exact attack class.

The Takeaway

Mango Markets was not hacked because of a Solidity bug. It was hacked because a risk parameter and an oracle architecture were incompatible with the liquidity profile of the asset they were pricing. The code did exactly what it was told. The instructions were wrong.

Write your collateral listings like an attacker is reading them. Because one is.