Ostium Hit by 5-Minute Oracle Incident as "Future" Price Report Triggers Up to $24M Vault Loss

Ostium, an on-chain perpetual trading platform, said a brief security incident lasting about five minutes led to losses in its public liquidity vault, with security firms estimating exposure of up to $24 million. Co-founder Kaledora Kiernan-Linn said the event occurred between 14:18 and 14:23 UTC on July 15 and impacted the public Ostium Liquidity Provider (OLP) treasury. She said the team detected the issue within minutes and arranged a trading pause within an hour. Ostium has not yet published a final loss figure, confirmed root cause, or released a full post-incident report. According to third-party analyses from Blockaid, Cyvers and SlowMist, the episode did not stem from missing signatures. Instead, an authorized oracle path was allegedly abused: a registered PriceUpKeep relayer submitted an oracle report with a timestamp set in the future, enabling trades to appear profitable and settle repeatedly against the vault. SlowMist said the manipulated data carried valid signatures from authorized signers. The reports emphasize a key distinction: cryptographic authentication can succeed even when the underlying data is unsafe. Reviewers pointed to OstiumVerifier logic that recovers the ECDSA signer and checks authorization, but does not itself enforce price sanity checks or timestamp bounds. It remains unclear from public information which implementation was live during the incident or whether additional contracts in the execution flow applied freshness, replay, deviation, or multi-source protections. Ostium's documentation says the OLP vault holds trader collateral and makes immediate on-chain payouts to winning positions. If fabricated profits are accepted as valid settlement, the vault's liquidity is used to fund those payments. Estimated losses have varied as tracing continued. Blockaid estimated payouts near $18 million, Cyvers put the figure at $23.7 million, and PeckShield later cited roughly $24 million drained. SlowMist reported a lower figure of $11.86 million, consistent with an observed treasury outflow of 11,862,444.782 USDC in referenced transactions. PeckShield said the withdrawn USDC was swapped for 12,080 ETH, and that 10,540 ETH had been sent to Tornado Cash as of its update. Kiernan-Linn said Ostium is working with law enforcement, SEAL 911 and external security specialists. Security researchers contrasted the incident with the recent Bonzo Lend event on Hedera, where a validator reportedly accepted a proof missing a valid signature. In Ostium's case, analysts argue the report passed signature checks because it came through an authorized signer route, making the integrity of the data itself the central issue. Ostium has not yet confirmed whether a signer key was compromised, whether an authorized operator acted maliciously, or whether other privileged pathways were exploited. Any remediation—such as isolating signers, enforcing strict timestamp boundaries, adding independent price checks, implementing rate limits and circuit breakers—will be judged on whether it can keep a trusted oracle path from turning minutes of bad data into vault losses.