Ajna Protocol’s oracle-free design faces $775K attack

Ajna Protocol, a lending platform that operates without price oracles, reportedly lost around $775,000 in ETH. The exploiters used the internal liquidation accounting of the platform instead of using third-party price feeds in their attack.

The assault impacted a number of liquidity pools, such as syrupUSDC, wstETH, rETH, cbETH, WBTC, WETH/USDC, and sDAI. However, it raises questions about an important aspect of Ajna’s philosophy – the absence of oracles and governance and the self-pricing market.

The attacker profited from this very assumption.

The oracle Ajna deliberately left out

The majority of lending protocols make use of an external service such as Chainlink to establish the prices of collateral. Ajna, however, intentionally does not do this. In fact, its white paper describes the protocol as follows:

“The Ajna protocol is a non-custodial, peer-to-peer, permissionless lending, borrowing and trading system that requires no governance or external price feeds to function.”

Rather, lenders determine the rates at which they will lend by putting money into “buckets” of a fixed amount, and it is the contracts in the protocol that determine when the loan is to be liquidated. For the initiation of a liquidation process, a liquidation bond should also be paid by the person initiating the liquidation process, imposing a financial penalty in case there is a liquidation without any justification.