Worked example · 2022-07

Nirvana Finance flash-loan-driven price manipulation — Solana — 2022-07-28

Loss: approximately $3.5M extracted from Nirvana Finance, a Solana-based algorithmic-stablecoin protocol whose ANA / NIRV token-pair design priced ANA against the protocol's own treasury. The drain was a single-block / short-burst extraction in which the attacker manipulated the ANA price within a flash-loaned position, minted ANA at the manipulated (inflated) price, and immediately redeemed it for treasury assets at the now-inflated rate.
Recovery: none. No public return of funds, no negotiated bounty, no attribution to a named individual. The Nirvana team disclosed the incident, attempted public engagement with the attacker, and offered a bounty that went unanswered. The protocol did not recover; ANA and NIRV depegged and the protocol effectively wound down.
OAK Techniques observed: OAK-T9.001 (Oracle / Pricing-Source Manipulation) — primary; OAK-T9.002 (Flash-Loan-Driven Manipulation) — primary co-classification, as the flash loan was both the capital mechanism and structurally inseparable from the price manipulation. The two together are the standard "flash-loan-driven oracle / pricing manipulation" combination familiar from EVM-side cases (bZx 2020, Harvest 2020) but instantiated on Solana against a treasury-priced algorithmic stablecoin rather than a lending-pool-priced collateral. Downstream OAK-T7 outflow patterns observed in the same-chain laundering of the proceeds.
Attribution: pseudonymous. No public named-individual attribution. The attacker did not respond to Nirvana's bounty offer. There is no FBI / DOJ / Treasury attribution as of the OAK v0.1 cut.
Key teaching point: on-protocol pricing of a token against the protocol's own treasury, without external oracle anchoring, is a self-referential T9.001 surface. Nirvana's ANA was priced by Nirvana's own bonding-curve / treasury logic. There was no external oracle in the conventional T9.001 sense — no Pyth, no Switchboard, no Chainlink-equivalent feed. The "oracle" the attacker manipulated was the protocol's own internal pricing function, manipulated via the protocol's own deposit / withdraw surface within a flash-loaned position. This is a Solana-ecosystem instance of the same self-referential-pricing failure class that produced bZx 2020 and Harvest 2020 on EVM. Defenders writing T9.001 mitigations should treat self-referential pricing (on-protocol price-from-own-state) as a strict superset of the conventional external-oracle-manipulation surface, with the Nirvana case as the Solana-side anchor.

Summary

Nirvana Finance was an algorithmic-stablecoin protocol on Solana with a two-token design: ANA was a treasury-anchored "rebound" token whose price was determined by Nirvana's bonding-curve logic against the protocol's USDC-denominated treasury, and NIRV was a stablecoin minted against ANA at a fixed peg. The intent of the design was that ANA's price would track the treasury's growth and that NIRV would inherit a USD peg from the ANA-treasury accounting.

On 2022-07-28, an attacker executed a flash-loan-driven price-manipulation exploit against Nirvana's ANA pricing. The attack pattern was:

Borrow a large flash loan from Solend (approximately 10M USDC) to fund the manipulation position.
Deposit a portion of the borrowed USDC into Nirvana's treasury / bonding-curve interface, causing Nirvana's internal pricing function to credit a higher per-ANA price (the bonding-curve mechanism reads the treasury's USDC balance as an input to the ANA price).
With ANA's internal price now inflated, mint a large quantity of ANA against the treasury at the inflated rate — receiving an ANA balance whose nominal value (in the protocol's own pricing) exceeded the actual treasury value backing it.
Immediately redeem the ANA back against the treasury at the still-inflated price, withdrawing more USDC than the original deposit.
Repay the flash loan and exit with the differential — approximately $3.5M.

The attack was a single-block extraction. ANA and NIRV depegged immediately upon recognition of the treasury drain. Nirvana's team disclosed the incident the same day, attempted public communication with the attacker, and offered a bounty for return of funds. The bounty was not accepted; no funds were returned. The protocol did not recover; the team subsequently announced an effective wind-down.

For OAK's purposes Nirvana is the Solana-side worked example of the self-referential-pricing failure class that EVM produced in bZx 2020 (lending-pool-priced collateral manipulated via the same lending-pool surface) and Harvest 2020 (vault-priced share manipulated via deposits / withdrawals). The structural property is the same across all three: the protocol prices a token against its own state, and the protocol's own state is mutable by the attacker within the same transaction (via the flash loan). The Nirvana case adds the Solana-side instance to OAK v0.1's worked-example coverage of this class.

Timeline (UTC)

When	Event	OAK ref
Pre-event	Nirvana deploys ANA / NIRV bonding-curve protocol on Solana; ANA pricing is computed against the protocol's own treasury balance with no external oracle anchor	T9.001 surface (latent — self-referential pricing)
Pre-event	Attacker analyses Nirvana's bonding-curve logic and identifies the same-block manipulability of the price input	(off-OAK pre-event observation)
2022-07-28	Attacker submits attack transaction: Solend flash loan (~10M USDC); deposit into Nirvana inflates internal ANA price; mint ANA at inflated price; redeem against treasury for net withdrawal of ~$3.5M; repay flash loan	T9.001 + T9.002 extraction
2022-07-28	Nirvana detects treasury drain; ANA and NIRV depeg	(operator response)
2022-07-28	Nirvana team publishes public disclosure; offers bounty for return of funds	(recovery attempt)
Days following	No response from attacker; no funds returned	(recovery failed)
Weeks following	No public named-individual attribution; protocol effectively winds down	(final state)

What defenders observed

The pricing surface was the protocol's own state, not an external oracle. This is the load-bearing teaching point. Conventional T9.001 mitigations focus on hardening external oracles — TWAP windows, multi-venue inputs, deviation circuit breakers, Pyth / Switchboard quorum. None of those applied to Nirvana, because Nirvana did not consume an external price feed for ANA. The "price" was a function of the protocol's own treasury balance; the function was deterministic and audited, but its inputs were mutable by anyone with sufficient capital, and the flash loan supplied the capital. Defenders writing T9.001 mitigations must explicitly address self-referential pricing as a sub-class — external-oracle hardening does not protect against it.
The attack was structurally same-block. Once the attacker identified the manipulability, the actual extraction was bounded by transaction latency, not by drain pacing. The flash loan, the deposit, the mint, the redeem, and the repayment all settled within a single Solana block. No real-time anomaly detection would have caught the drain at the granularity required to prevent it; the only effective defence was at the protocol-design layer (price-input anti-manipulation invariants, e.g. requiring deposits to season for some block delay before they affect the pricing function).
The flash-loan + self-referential-pricing combination is the same EVM-side pattern adapted. bZx 2020 was the canonical EVM-side example: lending-pool-priced collateral was manipulated by the attacker depositing within the same transaction. Harvest 2020 was the canonical EVM-side vault-share variant: share-price-as-function-of-vault-state manipulated by same-block deposits. Nirvana 2022 is the Solana-side instance with an algorithmic-stablecoin / bonding-curve form factor. The structural property is identical; only the surface differs. T9.001 + T9.002 worked examples should preserve this cross-ecosystem isomorphism.
No recovery is the realistic outcome when the attacker doesn't engage. Nirvana's bounty offer went unanswered. This is the same outcome shape as Slope's 2022 wallet-incident bounty offer (also unanswered) and is materially different from the Crema 2022 outcome (10% bounty accepted, 90% returned). The Solana-ecosystem 2022 worked-example record spans the full recovery spectrum within a six-month window: full negotiated return (Crema), wealth-bracketed partial return (Cashio), no return (Nirvana). Recovery-framework documentation should treat all three as realistic branches.
Protocol wind-down is itself a defender observable. Nirvana did not attempt to relaunch or rebuild after the drain. The treasury was the protocol's solvency basis; with the treasury drained, NIRV had no path back to peg, and the algorithmic-stablecoin design did not admit a bailout structure. Defenders evaluating algorithmic-stablecoin designs should treat "no recovery path after a single sufficient-magnitude drain" as a structural property of the design class, not a one-off Nirvana-specific outcome. The Terra collapse two months earlier (2022-05) is a much-larger-scale instance of the same property.

What this example tells contributors writing future Technique pages

T9.001 needs explicit self-referential-pricing sub-class framing. External-oracle manipulation (Mango 2022, the canonical T9.001 case) and self-referential-pricing manipulation (Nirvana 2022, bZx 2020, Harvest 2020) share the high-level T9.001 family but have disjoint mitigation surfaces. T9.001 pages should explicitly cover both sub-classes and cite Nirvana as the canonical Solana-side self-referential case.
T9.001 + T9.002 co-classification should be standard for self-referential cases. The flash loan is structurally inseparable from the manipulation in self-referential-pricing cases; the attacker needs the temporary capital to move the price-input within a single transaction. Cases that fit this pattern should be co-classified rather than primary-classified one way and footnote the other.
Algorithmic-stablecoin / bonding-curve protocols are a recurring T9.001 + T9.002 surface. Beyond Nirvana, the broader algorithmic-stablecoin design class (Terra LUNA, Iron Finance, AMPL-class designs) has a structural exposure to self-referential-pricing attacks because the peg mechanism reads the protocol's own state. Worked examples in this design class should be expected to recur in the OAK corpus as new instances surface; Nirvana is the v0.1 anchor for the Solana-side instance.
Pseudonymous-with-no-recovery is the realistic attribution status for the un-engaged-attacker branch. Nirvana's bounty offer was unanswered; the attacker chose not to engage. This is one of the three realistic Solana-2022 outcome branches (alongside negotiated-bounty return and wealth-bracketed return). Recovery-framework documentation should not treat any one branch as the default.

Public references

[nirvanapostmortem2022] — Nirvana Finance official disclosure and post-incident communication, including the bounty offer.
[rektnirvana2022] — Rekt News forensic write-up of the Nirvana exploit, including the flash-loan + bonding-curve manipulation framing.
[peckshieldnirvana2022] — PeckShield on-chain trace and analysis of the attack transaction.
[slowmistnirvana2022] — SlowMist incident analysis of the Nirvana / Solend flash-loan leg.
[halbornnirvana2022] — Halborn analysis of the bonding-curve self-referential-pricing pattern.
See also /examples/2022-10-mango-markets.md ([cftcmango2023]) for the external-oracle T9.001 sub-class on Solana, contrasted with Nirvana's self-referential T9.001 sub-class.

Discussion

Nirvana is OAK's canonical Solana-side worked example of the T9.001 self-referential-pricing sub-class — the failure mode in which a protocol prices a token against its own state and an attacker manipulates the state within a flash-loaned position to extract value at the manipulated rate. The structural property is identical to bZx 2020 and Harvest 2020 on EVM; the Solana instance differs only in surface (algorithmic-stablecoin / bonding-curve form factor) and tooling (Solend flash loan rather than Aave / dYdX). The cross-ecosystem isomorphism is the load-bearing teaching point: T9.001 mitigation at the self-referential sub-class is the same problem on every chain, and no chain's tooling maturity automatically closes the surface.

The pairing of Nirvana with Mango Markets (October 2022, external-oracle T9.001 sub-class) gives OAK v0.1 both Solana-side T9.001 sub-classes in worked-example form. Mango is the external-oracle case; Nirvana is the self-referential case. The two together establish that T9.001 is a real Solana-ecosystem class with internal sub-structure, not a single failure mode.

The recovery outcome — bounty offered, unanswered, no funds returned, protocol wind-down — adds the no-recovery branch to the Solana-2022 worked-example record. Combined with Cashio (wealth-bracketed partial return) and Crema (negotiated full return), the OAK v0.1 Solana-2022 worked-example set spans the full recovery spectrum, which is itself a documentable framework artefact: contributors writing future Solana-ecosystem worked examples should expect outcomes anywhere along this spectrum and should not default to any one branch.