One manipulated number was enough to wipe out almost everything. Balance Coin, an algorithmic stablecoin tied to the 42DAO protocol, fell from roughly $1 to $0.0014 after an attacker exploited a flaw in its oracle pricing system, erasing more than 99% of its value and effectively zeroing out a market cap that had stood at around $3.5 million.

How a Single Fake Price Drained $912,000

Blockchain security firm SlowMist dissected the attack and found the entry point: the protocol's Median Oracle accepted an artificially depressed Bitcoin price without running any meaningful checks on it. The attacker used the "poke" function inside the Spotter module to push that fraudulent BTCB price into the system, then called the "bark" function in the Dog module to trigger liquidations immediately, with no waiting period and no secondary oracle confirmation required.

Because the Spotter module had no price deviation controls, no maximum depreciation cap, and no minimum price floor, the bogus figure flowed straight into the VAT accounting module. From there the Dog module acted on it instantly. Multiple BTCB-collateralized vaults that should never have been touched were liquidated in a single transaction. The attacker converted the seized collateral into other assets and walked away with approximately $912,000.

What Was Missing in the Code

SlowMist's post-mortem points to a cluster of absent safeguards that, taken together, made the attack almost trivially easy to execute:

  • No price deviation check to flag an incoming value far below market rate
  • No maximum depreciation limit to cap how sharply a reported price could drop in one update
  • No minimum price protection to reject obviously absurd inputs
  • No time delay or secondary oracle requirement before liquidations could fire

Oracle manipulation is not a new attack vector. Similar mechanics wrecked Mango Markets in 2022 and contributed to several smaller DeFi collapses since. What makes the 42DAO case notable is how straightforward the exploit path was: public functions, no flash loan needed, no complex multi-step contract interaction. Just a bad price, accepted without question, and a liquidation engine ready to act on it.

The 42DAO team had not published an official post-mortem or recovery plan at the time of writing. Balance Coin holders are left with tokens worth fractions of a cent.

This article is for informational purposes only and does not constitute financial advice. Crypto assets carry significant risk, including total loss of capital.