Between 14:18 and 14:23 UTC, an attacker submitted future-dated, correctly signed price reports through Ostium’s own PriceUpKeep forwarder. The reports carried timestamps ahead of block time and prices that bore no relation to any market. Because the Verifier only validated the signer’s identity — not the plausibility of the price or the freshness of the timestamp — the protocol accepted the reports as legitimate. The attacker then opened and closed roughly twenty leveraged positions in a loop, each time collecting a payout from the OLP vault that reflected the fake profit. The vault’s payout logic trusted the forged input, so it settled trades that were profitable only because the feed itself had been faked.
The root cause was a compromise of off-chain credentials. The attacker obtained both an authorized oracle-signer key and a registered keeper role, which are intended to be tightly controlled by Ostium governance. With those credentials, the attacker could sign price reports that the Verifier could not distinguish from genuine ones. The smart contracts executed exactly as programmed; they simply acted on fraudulent instructions from someone who had access they should not have had.