🧵 Longbow (Robinhood Chain) — spot-oracle exploit, technical post-mortem + still-open advisory 1/ 🚨 Security advisory for @longbowlend The NOTHING market on Longbow was drained via spot-oracle price manipulation. The root cause is a design choice in the market's oracle — and as of Robinhood Chain block 55,530,002 it is still not fixed. Full on-chain breakdown 👇 #DeFiSecurity# 2/ The oracle. Market NOTHING (id 0x071fb8a9…f4b0be) is priced by 0x0F932e0fE68B0219820ffcB4C2B1906E29BedacC. Disassembling it: it reads a Uniswap v4 pool slot0 directly via extsload. No observe(), no TWAP. Longbow's own API labels its oracleType: "spot". 3/ Why that's fatal. Morpho Blue calls oracle.price() inside both borrow and liquidate. An instantaneous AMM spot price is movable within a single transaction, so the collateral valuation can be inflated and deflated atomically by the same caller. This is the textbook spot-oracle failure. 4/ The attack — tx 0x414b5b7c832b67dcd0c3f16907c8702ff794ce9dd0b749d0100e7549ba202d49 (a contract-creation whose constructor ran the whole thing atomically): ① pump the v4 pool ② supplyCollateral 20,599 NOTHING ③ borrow 24,691.89 USDG ④ dump NOTHING back into the pool 5/ ⑤ liquidate its own position, repaying only 914.45 USDG → Morpho returns all 20,599 NOTHING to the liquidator (= attacker) ⑥ sell the returned collateral ⑦ net 17,800.74 USDG to an EOA badDebtAssets written off: 23,777.45 USDG. 6/ Where the loss landed. The bad debt was socialized 100% onto the MonkeyHood / Partner VaultV2 0x19d55f7FE2d3962796F5825CbDae2dd493Be0986, which held 100% of that market's supply shares. The vault realized a ~95% write-down that has not recovered since. 7/ ⚠️ STILL OPEN — verified today at block 55,530,002: • oracle address unchanged (still the extsload/slot0 contract) • vault collateralToken cap still 50,000 USDG (not zeroed) • price() still live & manipulable • no remediation tx — only a 414 USDG adapter withdrawal since 8/ Fairness / scope: this is NOT a Morpho bug. @MorphoLabs markets are permissionless and behaving exactly as specified, and Morpho's own oracle guidance warns against raw AMM spot feeds. The vulnerable decision is Longbow's: a spot oracle wired to a live market with a non-zero cap. 9/ The rest of Longbow is not exposed to this vector — the other 54 markets use Uniswap V3 TWAP (e.g. PONS, backed by a deep pool w/ observationCardinality 20,000) or Chainlink feeds. NOTHING is the only market reading a raw spot price. But one open market is enough. 10/ Actionable asks for @longbowlend: 1️⃣ set the NOTHING collateralToken cap to 0 (stops new allocation immediately, no timelock) 2️⃣ retire/replace the oracle with a TWAP or Chainlink feed 3️⃣ audit every market's oracle bytecode for slot0/extsload vs observe()/latestRoundData 11/ cc curators & ecosystem for visibility: @SteakhouseFi @robinhoodcrypto @ponsdotfamily Read-only analysis, no funds touched, all reasoning reproduced on a mainnet fork. Reproducible IOCs above. #DeFi# #RobinhoodChain# #bow#