-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0309
============================================================

Advisory-ID:  0xCERT-2026-0309
Severity:     Medium
Published:    2026-11-04T02:32:10.000Z
Updated:      2026-11-05T00:43:16.998Z
Chains:       BNB Chain
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0309

Title: CoreVault on BNB Chain: flash-loan oracle attack inflates redemption about 33x and drains InsurancePool of about $112K

Summary
- -------
A flash-loan-funded oracle manipulation let an attacker redeem from CoreVault at about 33x fair value, draining its InsurancePool on BNB Chain; CertiK puts the attacker's take at 160.26 BNB (~$112.2K). Avoid the contracts until a fix is published and screen the listed indicators.

Details
- -------
Summary
CertiK Alert reported that a flash-loan-funded oracle attack on BNB Chain inflated a CoreVault redemption by about 33x and depleted the associated InsurancePool. Per CertiK, the attacker was left with 160.26 BNB (about $112.2K) after reversing the trade. TenArmor separately flagged a suspected attack on the InsurancePool and CoreVault contracts with losses of about $112.3K. The exploit transaction was mined on 3 November 2026 (UTC); CertiK's alert followed on 4 November.

Affected
- - CoreVault / InsurancePool contracts on BNB Chain (contract addresses and project team not identified by the sources)
- - Fixed in: No fix or post-mortem announced at time of publication

Impact
According to CertiK, the attacker used a flash loan to manipulate the price oracle used by CoreVault, so a redemption paid out roughly 33 times its fair value, with the excess drawn from the InsurancePool. Funds were drained in a single exploit transaction. Exploitation in the wild is confirmed by the sources. No recovery or compensation plan had been announced at time of publication.

Recommended actions
- - Do not deposit into or interact with CoreVault / InsurancePool until the team publishes a post-mortem and fix.
- - Protocols that price redemptions from AMM spot prices should switch to manipulation-resistant oracles (TWAP or external feeds) and cap per-transaction redemption sizes.
- - Wallets, exchanges and screening providers: add the indicators below to monitoring to flag movements of the stolen BNB.

Indicators
- - Exploit transaction hash as published by CertiK Alert.
- - Attacker EOA and exploit contract are the sender and the contract created by that transaction, as recorded on-chain (BNB Chain receipt for the CertiK-cited transaction, block 131507810).

Source & attribution
This 0xCERT advisory summarises an alert by CertiK Alert: https://x.com/CertiKAlert/status/2117807084939129050, corroborated by TenArmor's alert as reported by Phemex News: https://phemex.com/news/article/insurancepool-and-corevault-contracts-on-bsc-hit-by-suspected-attack-112k-lost-102297. Details may change; refer to the original source for the authoritative record.

References
- ----------
- - https://x.com/CertiKAlert/status/2117807084939129050
- - https://bscscan.com/tx/0x072a10a579e2a8afa26a681205a2aaaa38f74bcb9d1064b12bd9e9ebe2c598b3
- - https://phemex.com/news/article/insurancepool-and-corevault-contracts-on-bsc-hit-by-suspected-attack-112k-lost-102297
- - https://www.techflowpost.com/en-US/newsletter/142845

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0FgmrtEFEJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmegqSsbueLTl74HH/KA5fJQ/dXjf1qjcoh5WTFt
y6hfqRYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAADwIAD+IW76sIaFwRll+x5W
JUB6OW/PZcyFwrGr0QKvg0jSOyEA+waEVYp9ZRxwd5520z8iMvqsf/ox+bJL
TQqa/aTPCesL
=HeMn
-----END PGP SIGNATURE-----