Summary

Between 05:30 - 06:00 UTC and 15:00 - 16:30 UTC on December 4th 2021 a number of faulty MSOL prices were pushed to the mango cache (in some cases reaching as high as ~$600). The prices originated in Pyth MSOL oracle with large confidence intervals. They were pushed into MangoCache because the Mango program was not making use of the Pyth confidence intervals.

As liquidations use the mango cache prices to determine the account health this led to several wrongful liquidations.

We identified 3 accounts effected - totaling $124k of liquidated assets. Using corrected prices the net amount lost by affected accounts was $81k. Once we add 10% to account for inconvenience and opportunity cost, the refund comes to 89,215.86 paid out in USDC.

Methodology

• Collect all liquidations over Dec 4th
• Filter for liqees with positive MSOL borrows (immediately before liquidation)
• As it happened - this resulted in only liquidations involving MSOL as the liquidated liability (which simplified matters as we didn't have to consider cases where another liability was liquidated due to MSOL lowering the health of the account)
• Compare MSOL prices for these liquidations to SOL prices at the same time to identify incorrect prices (MSOL price should be ~1.02 SOL at the time). This left us with 3 wrongful liquidations
• Calculate the refund by taking the value of the liquidated assets and subtracting the value of the liquidated liabilities at corrected MSOL prices

Accounts Affected

• 2djENyoL1HhRj3dELXv2N5z6buuyinrGfTd7Dn9asvST
• 2nxUQGyysW7FB7apwjkFdnReZq2bA1JmgqT67fdaRUTE
• 62tjaFUr1cjTyHbZWzo6UW2NYEmuXzxWdLZhJ7mMxUxw

Below is a spreadsheet with all the relevant info about the liquidations and the calculations done for the compensation:

https://docs.google.com/spreadsheets/d/1D7FBB-t4zD4OwTBJ8XGJ53A-bRgrDMEZd10zLNnijjU/edit?usp=sharing

Remedy

The Mango program was patched to filter out Pyth oracle prices where confidence interval exceeds 10% of the price: https://github.com/blockworks-foundation/mango-v3/commit/7ff9e2c93e67cc467782048790f39c390e7aa280

Daffy compensated the accounts mentioned with a 10% inconvenience fee. These were the txs:

• 76723.12 USDC to 2djENyoL1HhRj3dELXv2N5z6buuyinrGfTd7Dn9asvST https://explorer.solana.com/tx/4dy8Yzqvg75L4ghMpWe45euAztBiH6gXrKf8RFaHYySan5Xzqf57UAvQKfzj5a2StsXu1bXdtYTDqjvbTicsZnin