OAK — OnChain Attack Knowledge

Worked example · 2023-05

Mango Markets orderbook spoofing via fake-liquidity deployment — Solana — 2023-05 to 2023-08

Loss
aggregate mid-six-figures USD in spoof-induced adverse-execution losses for market-takers on Mango Markets V4 (Solana order-book DEX and perpetuals venue). The spoofing pattern — large limit orders posted and cancelled before execution — manufactured an apparent-depth signal that misled market-takers into adjusting their order placement and market-taking decisions. Market-takers who executed against the apparent liquidity (by moving their orders toward the spoofed price level) received systematically worse execution than they would have received under the true order-book state. Individual adverse-execution losses range from low-four-figures to low-five-figures USD per manipulated order-book window.
OAK Techniques observed
OAK-T17.003 (Spoofing / Cancel-Flood Order-Book Manipulation — primary; the load-bearing manipulation primitive was one-sided spoofing: large limit orders posted on the Mango Markets order book to display false depth, then cancelled before execution, while the attacker's economically-real trades were on the opposite side of the spoof). OAK-T8.001 (Operational Reuse — Cluster-Reuse Signal — load-bearing for the cross-account correlation; the spoof orders and economically-real trades were executed from different accounts whose funder-graph clustered together). OAK-T17.001 (Cross-Venue Arbitrage Price Distortion — structurally adjacent; some spoof campaigns on Mango Markets correlated with opposite-side exposure on Serum or centralised venues, though the primary extraction was on-venue adverse-execution rather than cross-venue profit-realisation).
Attribution
pseudonymous The spoof-and-cancel wallet clusters are observable through Mango Markets on-chain settlement data and per-order event streams where preserved by the venue's matching engine. No individual operators have been publicly identified or attributed. No regulatory enforcement action.
Key teaching point
Mango Markets V4's on-chain order-book architecture — where resting orders are committed as Solana transactions — makes the T17.003 surface partially observable on-chain, unlike off-chain-order-book DEXes (dYdX, Hyperliquid) where the per-order event stream is venue-side only. The on-chain observability of Mango Markets order placement and cancellation means that spoof-and-cancel patterns can be reconstructed from the Solana transaction record without venue-side cooperation — the load-bearing T17.003 forensic signal is on-chain-accessible on Mango Markets in a way it is not on off-chain-order-book DEXes. This makes Mango Markets a structurally distinctive T17.003 venue: the defender's detection surface is on-chain rather than venue-internal.

Summary

Mango Markets is a Solana-native order-book DEX and perpetuals trading venue, with its V4 iteration (launched 2023) operating a fully on-chain order book where resting limit orders are committed as Solana transactions and stored in on-chain order-book state. Unlike off-chain-order-book DEXes (dYdX, Hyperliquid) where the matching engine and order book operate at the venue / sequencer layer with only settlements landing on-chain, Mango Markets V4's on-chain architecture means that order placement, modification, cancellation, and fill events are all preserved in the Solana transaction record.

During May to August 2023, spoofing campaigns were observed on Mango Markets V4 targeting medium-liquidity perpetuals pairs (SOL-PERP, MNGO-PERP, and select alt-coin perpetuals). The spoofing pattern was a classic one-sided spoof: the attacker posted large limit orders on one side of the order book (e.g., large bids at progressively higher prices to display upward demand), other market participants observed the apparent depth and adjusted their own order placement or market-taking decisions, and the attacker cancelled the spoof orders before execution. The attacker's economically-real trades were on the opposite side of the spoof: large posted bids correlated with executed sells, large posted asks correlated with executed buys.

Because Mango Markets V4's order book is on-chain, the spoof-and-cancel pattern was partially reconstructible from the Solana transaction record: the attacker's order-placement transactions (large limit orders) and order-cancellation transactions (following within seconds, before the orders could fill) were observable on-chain. The economically-real trades (opposite-side executions) were observable from the fill-event records. The cross-account correlation — spoof orders posted from one account, economically-real trades from a different account — was surfaced through funder-graph clustering (T8.001) rather than through per-order analysis.

The campaigns were lower-value than the Hyperliquid POPCAT November 2025 spoof-and-cancel because (a) the Mango Markets order-book depth for the targeted pairs was thin, capping the manipulation amplitude; (b) the attacker's capital deployment was smaller (~$50K–$200K for spoof-order posting per campaign); and (c) the extraction was adverse-execution for market-takers rather than a liquidation cascade that accrued bad debt to a protocol vault. Nonetheless, the campaigns are structurally significant as a T17.003 anchor on an on-chain-order-book venue — demonstrating that the forensic signal lives on-chain, not at the venue-internal layer.

The case sits between the CFTC vs Sarao 2015 anchor (traditional-finance equity-futures order book, off-chain matching, venue-side enforcement record) and the Hyperliquid POPCAT November 2025 anchor (crypto-perp-DEX, off-chain matching, cross-venue profit-realisation). Mango Markets V4 is the on-chain-order-book crypto-DEX sub-domain: the spoof pattern is the same, but the detection surface is on-chain rather than venue-internal.

Timeline (UTC)

When Event OAK ref
2023-Q2 Mango Markets V4 launches with fully on-chain order book; resting limit orders committed as Solana transactions (standing T17.003 surface — on-chain order book makes per-order lifecycle observable)
2023-05 to 2023-07 First spoofing campaigns: large limit orders posted on medium-liquidity perps (SOL-PERP, MNGO-PERP) to display false depth; cancelled before execution while attacker executes opposite-side trades from different account T17.003 (one-sided spoof — on-chain order placement + cancellation)
2023-07 to 2023-08 Campaigns expand to additional perp pairs; cross-account correlation (spoof vs execute accounts) surfaced through funder-graph clustering; aggregate adverse-execution extraction in mid-six-figures T17.003 + T8.001 (cluster-attribution across spoof/execute accounts)
2023-08 onward Mango Markets community and on-chain analysts document spoof-and-cancel patterns; the on-chain order-book architecture makes the forensic signal reconstructible without venue-side cooperation (defender-side methodological development; on-chain T17.003 detection)
Continuing Mango Markets V4's on-chain order-book architecture remains a structurally distinctive T17.003 surface: detection is on-chain-accessible but cancellation-rate thresholds must distinguish spoofing from honest market-making T17.003 (ongoing surface)

Realised extraction

Aggregate mid-six-figures USD in spoof-induced adverse-execution losses for market-takers. Per-campaign extraction was bounded by the thin order-book depth for the targeted pairs and the attacker's spoof-order capital deployment (~$50K–$200K per campaign). The extraction mechanism — market-takers receiving systematically worse execution than under the true order-book state — operates through the bid-ask spread: market-takers who adjust their orders toward the spoofed price level pay a wider effective spread than the true order-book state would have produced.

Public references

  • Mango Markets V4 on-chain order-book architecture — order placement, cancellation, and fill event records on Solana
  • Mango Markets community channels — spoof-and-cancel pattern discussion and on-chain reconstruction (2023)
  • Solana on-chain data (Solscan, SolanaFM) — per-order lifecycle transactions for Mango Markets V4 order-book events
  • Cross-reference: T17.003 at techniques/T17.003-orderbook-spoofing-cancel-flood.md
  • Cross-reference: examples/2010-2015-navinder-sarao-cme-futures-spoofing.md — Navinder Sarao / CME futures spoofing (traditional-finance T17.003 anchor)
  • Cross-reference: examples/2025-11-hyperliquid-popcat-spoof-and-pull.md — Hyperliquid POPCAT spoofed-buy-wall + cancel-flood (crypto-perp-DEX T17.003 anchor)
  • [zhou2023sok] — academic taxonomy classifying spoofing as a recurring market-manipulation class

Techniques demonstrated (3)