Cozy Finance $160k Loss Tied to UMA Oracle Logic Flaw
SlowMist reports Cozy Finance contract accepted any undisputed YES=1e18 UMA proposal as an attack trigger without verification.
SlowMist disclosed that Cozy Finance lost approximately $160,000 after its contract automatically treated an undisputed YES=1e18 price proposal submitted via the UMA Optimistic Oracle as an external attack event.
The contract accepted the proposal from any address and did not perform independent verification before triggering the response.
Open questions
The exact loss amount remains unconfirmed, as does whether any funds have been recovered.
It is also unknown whether the proposal was submitted with malicious intent or in error, and whether a patch has since been deployed.