According to the Odaily Planet Daily report, Mango officially tweeted that it was taking measures to deal with it, and hoped that the hacker would take the initiative to contact to discuss repayment (part of it can be reserved as a bounty): "We are taking measures to allow third parties to freeze liquidity. As a precautionary measure, we are disabling deposits on the front end and will provide updates as the situation develops.”

Different from the plot trends of previous attacks, this time the hacker was "very fun" and released a new governance proposal on realms: it is hoped that Mango will officially use the project treasury funds ($70 million) to repay users' bad debts; if Officials agreed that the hackers would return some of the stolen funds while hoping to avoid criminal investigations or freeze assets. Some encryption enthusiasts commented that the Mango hacker is playing DeFi and DAO well.

As of now, the proposal has received 32.9 million votes in favor, of which 32.41 million votes were cast by the hackers themselves, and there is still half a distance to pass the threshold (67.09 million votes).

In response to this incident, the Chengdu Chain Security team conducted an analysis.

1_Explanation of "price manipulation" attack methods

The hacker used two accounts with a total of 10 million USDT initial funds.
In the first step, the attacker deposited 5MUSDC into the Mango market.

In the second step, the attacker created a 483M PlacePerpOrder2 position in the MNGO-ERP market.

In the third step, the price of the MNGO was manipulated, from $0.0382 to $0.91, by using a separate account (Account 2) for counterparty trading of its position.

Account 2

Account 2 now has 483*($0.91-$0.03298) = $423 million, which allows the attacker to lend out $116 million in funds.

2_The project direction hackers compromise?

The hacker made a proposal on Mango governance to try to negotiate a bounty. The proposal calls for MangoTreasury to pay $70 million to repay bad debts. Hackers will give up half of the proceeds to avoid legal prosecution.

It is understood that the current project treasury funds are about 144 million US dollars, including MNGO tokens worth 88.5 million US dollars and USDC nearly 60 million US dollars.

The hacker said that if officials agreed to the above plan, some of the stolen funds would be returned, and they hoped that there would be no criminal investigation or freezing of funds. “If this proposal goes through, I will send the MSOL, SOL and MNGO in this account to the address published by the Mango team. The Mango project treasury will be used to cover the bad debts remaining in the agreement, and all users with bad debts will be fully compensated...once Tokens are sent back as described above without any criminal investigation or freezing of funds.”

According to the previous statistics, the amount of assets returned by the hacker plan is about 49.43 million US dollars, which is about 42% of the stolen funds, which means that nearly half of the stolen assets are left by the hackers as a "bounty". The ratio is much higher than the official promised upper limit in previous attacks.

Mango officials said that the best solution at present is to communicate with the attacker. “The Mango DAO’s priorities are: preventing any further unnecessary losses, securing the depositor funds of the Mango Protocol, and trying to save some of the value of the Mango DAO. Mango believes the most constructive way to address this is to continue working with the responsible incidents and communicate with those in control of the funds removed from the protocol to try to resolve the issue amicably.”

It is unclear whether officials will eventually agree to the proposal and implement it. As of press time, the hacker proposal has received 32.9 million votes in favor, of which 32.41 million votes were cast by the hackers themselves, which is still a long way from passing the threshold of 67.09 million votes.