# Cozy Finance: fraudulent UMA oracle answer drains protection reserve

Cozy Finance's UMA trigger accepted a permissionless fraudulent YES proposal, letting attacker buy protection cheaply and claim full payout, draining ~$160K USDC.e.

- Payout: Real-world hack
- Severity: critical
- Program: CozyFinance
- Disclosed: 2026-09-07
- Write-up quality: 8/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-09/CozyFinance_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260907-cozyfinance
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** Cozy protection-market Set + UMA OptimisticOracleV2 trigger on Optimism
**Root cause:** UMATrigger.priceProposed only checks proposedPrice == AFFIRMATIVE and does not verify the underlying event occurred; anyone can propose via permissionless OptimisticOracleV2, and CPT eligibility is not snapshotted before the proposal.
**Steps:**
1. Attacker contract calls `OptimisticOracleV2.proposePrice(requester, identifier, timestamp, ancillaryData, 1e18)` posting bond for the Aave-hack query
2. In same tx, buy CPT via `Set.purchase(marketId, protection, receiver)` at normal premium for markets 5 and 0
3. Wait 432,000s liveness (5 days) with no dispute
4. Call `UMATrigger.runProgrammaticCheck()` to settle; priceSettled flips state to TRIGGERED
5. Call `Set.claim(marketId, protectionTokens, receiver, owner)` to redeem CPT for full protected notional, draining USDC.e reserve
**How found:** Reading the verified UMATrigger source revealed priceProposed only checks msg.sender==oracle and proposedPrice==AFFIRMATIVE with no event verification; combined with permissionless proposePrice and no CPT snapshot, the path was clear.
**Exploitation:** Attacker posted ~2,631 USDC in premiums plus 2x1,000 USDC UMA bonds, proposed fraudulent YES answers on two markets, waited out the 5-day liveness, settled the oracle, and claimed full payout (~160,776 USDC.e) against the Set's entire reserve.
**Escalation:** Hit two markets (5 and 0) simultaneously to drain the entire Set reserve rather than a single market.
**Insight:** When a protocol outsources truth to an optimistic oracle, check whether the trigger contract independently validates the claimed event or merely trusts an unchallenged proposal — and whether token eligibility is snapshotted before the proposal timestamp.