On-chain data doesn't lie. On March 14, 2026, block 19,442,871 on Ethereum mainnet recorded a flash loan attack that drained 2.1 million USDC from four lending pools on the same protocol. The exploit vector? Not a reentrancy bug. Not a faulty liquidation mechanism. A single compromised Chainlink price feed for the EURT/USD pair, updated with a stale price that was 40% below the actual market rate.
I've seen this pattern before. As a DeFi security auditor based in Chengdu, I've audited over 60 lending protocols since 2022. The code is often clean. The math is sound. The vulnerability hides in plain sight—in the assumptions made about external data sources.
Context: The Protocol Mechanics The target protocol, let's call it 'LendVault', is a permissionless lending market that accepts multiple assets as collateral, including a synthetic euro stablecoin called EURT. LendVault uses a custom oracle aggregator that pulls from three sources: Chainlink, Uniswap TWAP, and a fallback from a centralized exchange API. The design is standard—if two of three sources agree, the price is accepted. But the flaw was in the fallback logic.
When Chainlink's EURT/USD feed went stale (no new round for 6 hours due to a node runner upgrade), the aggregator's fallback fired. It picked up the Uniswap TWAP for EURT/USDC, which was itself manipulated via a series of small swaps over the previous 10 blocks. The aggregator's code didn't check for a reasonable deviation between the Chainlink price and the Uniswap price. It simply accepted the first two agreeing sources. The result: EURT was undervalued by 40% for 12 minutes.
Core: Code-Level Analysis and Trade-offs Let me walk through the relevant Solidity snippet. The aggregator contract had a function getPrice(address asset):
