CozyFinance exploit analysis

A Cozy Finance v2 protection market on Optimism let anyone feed an unverified answer through the UMA Optimistic Oracle. The market was a Cozy Set around a UMA-backed trigger for the question "Did Aave v2 get hacked?". The trigger's _submitRequestToOracle posts a YES_OR_NO_QUERY event to OptimisticOracleV2 and waits for a proposal. OptimisticOracleV2.proposePrice is permissionless: any address can submit an answer by posting the bond. The trigger's priceProposed callback did not check whether the underlying event actually happened. It only reverted if the proposed price was anything other than the affirmative 1e18. A bare "YES" from an arbitrary address was therefore accepted and the market flipped to frozen.

The attacker (EOA 0x003FE7359A4E03C85Ac2f521eC699ED84C7c5ccB) ran the attack in two transactions on Optimism, ~216,000 blocks, or about five days, apart, matching UMA's custom 432,000-second liveness window. The first transaction (0x53b454a3f552c5498994f74ae8737faa60123cac274bdd3b0383ccb226b3f2cb on block 156364035) bought protection on the Set and proposed the fraudulent affirmative answer in the same atomic sequence. The second transaction (0x8761164b8947a0690b57896a8e7370dd69fe8e9137ce61e0b21ff08581a2ce60 on block 156580507) settled the oracle and called the trigger's runProgrammaticCheck(), which flipped the trigger to TRIGGERED once the dispute window had passed without challenge.

Because the protection-token (CPT) eligibility was not snapshotted before the proposal, the attacker was able to buy CPT at the normal small premium in the same transaction as the proposal, then redeem that CPT against the now-triggered Set for the full protected notional. The Set at 0x17705474203f7ff7ba8a940c433ab43d1f58e249 (an EIP-1167 clone of the set logic at 0x17aff89b) held a USDC.e reserve at 0x7F5c764cBc14f9669B88837ca1490cCa17c31607, and the attacker drained ~160,776 USDC.e out of it.

The fix is to snapshot CPT holders before a proposal can be accepted and to require the proposal itself to come from a privileged role or an attestation chain independent of the trigger. The trigger also needs to verify that the event it claims to detect actually occurred, rather than treating an unchallenged UMA proposal as automatic truth.