Flash-loan oracle attack inflates CoreVault redemptions 33x, drains 160.26 BNB

CoreVault is a BNB Chain vault that pays out redemptions based on an oracle-fed price, a design that has broken before: bZx in 2020, Harvest Finance the same year, and Cream Finance in 2021 all lost funds to attackers who used flash loans to distort the price a contract trusted for a single block. CertiK Alert says this attack followed the same script, inflating a redemption by roughly 33 times before the InsurancePool paid out 160.26 BNB.

With the InsurancePool emptied, CoreVault no longer has the reserve it promised to cover shortfalls elsewhere in the protocol, so remaining depositors inherit a system with less of a backstop than they signed up for. SlowMist's $112,300 estimate, matching the 160.26 BNB haul, gives the team a fixed number to work from if it attempts reimbursement. Anyone still holding CoreVault positions faces a protocol that must now patch its oracle before redemptions can be trusted again.

Crypto Briefing frames this as another reminder that oracle security remains DeFi's weak joint, not a solved problem after years of similar losses. Protocols pricing assets off a single on-chain source during redemption windows are betting no one will borrow enough capital, even briefly, to move that price - a bet flash loans make cheap to win. The recurring pattern says less about one team's code and more about an industry still reluctant to pay for the redundancy that would prevent it.

Whether CoreVault publishes a post-mortem naming the exact oracle it relied on, and whether it attempts to make InsurancePool depositors whole, will determine if the protocol survives this in anything like its current form. CertiK's $112,200 valuation and SlowMist's $112,300 figure for the same 160.26 BNB haul also leave a small but open question about how the loss gets recorded in each firm's incident database, a detail that matters for anyone tracking DeFi's running tally of oracle failures.