A NullMeridian record Andromeda Logs

NullMeridianLog

3 Nov 2026 (UTC, per Defimon)

CoreVault (BNIX/OSK): Spot-Price Oracle Inflated BNB Redemption ~33-Fold

Per Defimon and CertiK, a flash-loaned WBNB dump skewed CoreVault's spot-price oracle and inflated a principal redemption, draining its InsurancePool.

  • Event date
  • Incident typeSmart-contract exploit
  • Bug classOracle
  • Published

Loss, as sourced

InsurancePool drained of ~259 BNB (~$181K), attacker netted ~160 BNB (~$112K), per Defimon; 160.26 BNB (~$112.2K) attacker profit, per CertiK; ~$112.3K, per TenArmor.

Traceability

Primary sources

  1. 01x.comDefimon alert, 4 Nov 2026 04:43 UTC (opens in a new tab)
  2. 02x.comCertiK alert, 4 Nov 2026 02:33 UTC (opens in a new tab)
  3. 03x.comTenArmor alert, 4 Nov 2026 01:40 UTC (opens in a new tab)
  4. 04bscscan.comAttack tx, per Defimon, CertiK, TenArmor (opens in a new tab)

In brief

Root cause: Per Defimon: CoreVault priced BNB principal redemptions off a manipulable PancakeSwap spot price; OracleLib's 3-source median "degrades to the manipulated spot when TWAP/avg windows are unfilled".

Timeline, as sourced: TenArmor alert 4 Nov 01:40 UTC; CertiK 02:33 UTC; Defimon 04:43 UTC, dating the loss 3 Nov.

Account, as sourced

Per Defimon (alert (opens in a new tab)): the attacker flash-borrowed ~207K WBNB (Moolah) and dumped 195K WBNB into the WBNB/USDT pair, inflating the oracle's wbnbPerUsd. redeemPrincipal() then computed the BNB payout from the manipulated price; Treasury.payoutBnb and InsurancePool.withdrawReserve paid out ~260 BNB. The attacker swapped WBNB back, repaid the loan and netted ~160 BNB (~$112K). Attacker 0xd3565b191b28b49cc517189b984dacdb1ff05304 (opens in a new tab); victim 0xf40e0d525003fb6c6a9a7d79734a87a465053df1 (opens in a new tab).

Per CertiK (alert (opens in a new tab)): the oracle attack "inflated a CoreVault redemption ~33×, depleting InsurancePool", leaving the attacker 160.26 BNB (~$112.2K). TenArmor (alert (opens in a new tab)) puts the loss at ~$112.3K. All three cite the same tx (opens in a new tab).

Unknown: any statement from the project.

Summaries of public sources as of the published date; except where marked (on-chain), not independently verified by NullMeridian. Figures are the sources’ own and are attributed; where sources disagree, each is given. Sources may since have changed. Not legal, financial or investment advice.

Permalinkhttps://andromeda.observer/e/corevault-bnix-osk-spot-price-redemption