OAK — OnChain Attack Knowledge

Worked example · 2024-01

Gamma Strategies $3.4M Flash Loan Price Manipulation — 2024-01

Loss
$3.4M (~40K+ ARB tokens) extracted from Gamma Strategies' Hypervisor vaults on Arbitrum via flash-loan-funded price manipulation.
OAK Techniques observed
OAK-T9.001 (Oracle/Price Manipulation) — attacker manipulated the price feed used by Gamma's vault accounting logic via flash-loan-funded liquidity imbalance; OAK-T9.013 (Slippage Manipulation Sandwich Attack) — the extraction used deposit/withdrawal slippage amplification.
Attribution
pseudonymous — attacker addresses identified on Arbitrum. Gamma paused vaults, engaged security researchers, and negotiated a partial whitehat return.
Key teaching point
The Gamma Strategies exploit demonstrates the flash-loan price-manipulation-against-automated-vault pattern: the attacker manipulates the price used by an automated vault's deposit/withdrawal accounting via flash-loan-funded liquidity pool imbalance, then deposits at a manipulated low price and withdraws at the true price, extracting the difference from the vault's TVL. The Gamma vaults were active liquidity management positions (Uniswap V3 Hypervisors) whose deposit/withdrawal valuation relied on pool price oracles that a flash loan could temporarily deviate. Detection approach: monitor for deposit-then-withdraw sequences within a single block where the deposit and withdrawal valuations diverge by more than the pool's organic fee-and-slippage band.

Summary

On January 4, 2024, Gamma Strategies — an automated liquidity management protocol on Arbitrum (Uniswap V3 Hypervisor vaults) — was exploited for approximately $3.4M.

The attacker used flash loans to manipulate the price of assets in Gamma's managed liquidity pools. The attack sequence:

  1. Take a large flash loan
  2. Deposit into the manipulated pool through Gamma's vault, receiving vault shares at the manipulated (favorable) valuation
  3. Reverse the price manipulation (repay flash loan)
  4. Withdraw vault shares at the restored (true) valuation, extracting the valuation difference from vault TVL

Multiple Gamma Hypervisor vaults were affected. Gamma paused all vaults within hours, preventing further extraction. The team engaged security researchers (PeckShield, BlockSec) and negotiated a partial return of funds from an address that claimed whitehat intent (disputed — the address exploited the vault but returned funds after being contacted).

Timeline

When Event OAK ref
2024-01-04 Flash-loan-funded price manipulation against Gamma Hypervisor vaults. $3.4M extracted T9.001 / T9.013
2024-01-04 Gamma pauses all vaults, preventing further extraction (incident response)
2024-01-04 PeckShield, BlockSec publish on-chain analysis (public alert)
2024-01-05 Gamma announces partial fund return from one address (recovery)

What defenders observed

  • Deposit/withdrawal valuation oracle was the vulnerable surface. Gamma's vault share pricing relied on the pool's current price, which a flash loan could deviationally manipulate within a single block. The exploit did not involve a contract-logic vulnerability in the traditional sense — the vault functioned as designed, but the design assumed a manipulation-resistant price feed that did not exist at the single-block timescale.
  • Flash loan as the manipulation enabler. The attacker required no upfront capital beyond gas and flash-loan fees. The entire attack was atomic (single block). Multi-block TWAP oracles would have prevented this specific attack.
  • Multiple vaults affected — shared vulnerability surface. The same deposit/withdrawal valuation logic was deployed across multiple Gamma Hypervisor vaults, making them all exploitable via the same method. Per-vault vulnerability diversity would have limited blast radius.
  • Uniswap V3 concentrated liquidity as the price source. Gamma vaults were Uniswap V3 Hypervisors, meaning they managed concentrated liquidity positions. Concentrated liquidity amplifies price impact per unit of swap volume — the same flash loan size produces greater price deviation in a V3 pool than in a V2 constant-product pool.

What this example tells contributors

  • T9.001 (Oracle/Price Manipulation) is the canonical vault-exploit class for automated liquidity managers. Yearn, Rari, Gamma, and other vault protocols share this vulnerability surface: deposit/withdrawal valuation that uses a single-block manipulable price feed. The fix is well-understood (TWAP oracles, deposit/withdrawal delay, or deviation circuit-breakers) but must be implemented per-vault.
  • Concentrated liquidity amplifies price-manipulation vulnerability. Uniswap V3 pools are structurally more manipulable per unit of flash-loan capital than V2 pools. The OAK detection framework should distinguish between V2 and V3 price feeds.
  • Vault pause as effective incident response. Gamma's vault pause within hours prevented further extraction. Pause-by-default architecture (OAK-M34) is as relevant for vault protocols as for lending protocols.

Public references

Techniques demonstrated (2)