Mango Markets: spot price manipulation drained protocol liquidity

What happened

In October 2022, Mango Markets V3 on Solana lost approximately $116 million. The protocol's lending module relied on the spot price of the MANGO token to value collateral. Because the MANGO-PERP market had low liquidity and trading volume, the spot price was pushed from roughly $0.0382 to $0.91 per unit. This artificial inflation allowed a second account to book an unrealized profit of about $423 million, which was then used as collateral to borrow $116 million, draining the protocol's available liquidity. When the spot price subsequently collapsed back to around $0.02, the borrowed funds were already gone.

Why it was possible

The core defect was trusting a manipulable spot price from a thin order book as the sole source of truth for collateral valuation. The protocol did not cross-reference the MANGO token price against a time-weighted average or an independent oracle. In a low-liquidity environment, a single participant can shift the spot price dramatically within one transaction or block. Because the lending logic evaluated borrowing power against this instantaneous, unverified price, artificially inflated collateral translated directly into real withdrawals. The absence of deviation bounds or staleness checks meant the system treated a manipulated quote as legitimate.

How to protect your protocol

Never rely solely on spot DEX prices for collateral. Spot quotes on thin markets can be shifted cheaply within a single transaction. Use a time-weighted average price (TWAP) or a decentralized oracle network as the primary pricing source for any asset used as borrowing collateral.
Enforce deviation limits between price sources. Compare the spot price against a TWAP or external oracle on every valuation. If the spot deviates beyond a defined threshold, pause borrowing or fall back to the more conservative price source until the spread normalizes.
Assess and gate assets by liquidity depth. Before enabling an asset as collateral, measure its available liquidity and trading volume. Automatically disable borrowing against tokens whose order books are too shallow to resist single-actor price impact.
Decouple unrealized PnL from withdrawable collateral. Do not allow unrealized profits from perpetual positions to serve as immediate collateral for spot withdrawals. Require settlement, time delays, or independent verification before marking such gains as borrowable equity.
Monitor oracle health continuously. Deploy automated alerts for sudden price spikes, widening spreads between spot and TWAP, and drops in trading volume. Circuit breakers should trigger automatically when these metrics exceed safe thresholds.

Check your own code

Does every collateral valuation use a manipulation-resistant price source like a TWAP or decentralized oracle?
Is there a maximum allowed deviation between the spot price and the reference oracle before actions are paused?
Are assets with low liquidity depth restricted from being used as primary collateral?
Can unrealized profits from derivative positions be immediately withdrawn as spot collateral?
Are there automated circuit breakers that halt borrowing during abnormal price volatility?
How quickly does the pricing mechanism recover if a single actor moves the spot price?

Sources

Explained: The Mango Markets and Attempted Aave Hacks (October 2022)

How this was prepared: compiled from the sources above with the help of automated tools, then reviewed by the Foothold security team before publication.