🧵 Longbow (Robinhood Chain) — spot-oracle exploit, technical post-mortem + still-open advisory
1/
🚨 Security advisory for @longbowlend
The NOTHING market on Longbow was drained via spot-oracle price manipulation. The root cause is a design choice in the market's oracle — and as of Robinhood Chain block 55,530,002 it is still not fixed.
Full on-chain breakdown 👇 #DeFiSecurity
2/
The oracle. Market NOTHING (id 0x071fb8a9…f4b0be) is priced by
0x0F932e0fE68B0219820ffcB4C2B1906E29BedacC.
Disassembling it: it reads a Uniswap v4 pool slot0 directly via extsload. No observe(), no TWAP. Longbow's own API labels its oracleType: "spot".
3/
Why that's fatal. Morpho Blue calls oracle.price() inside both borrow and liquidate. An instantaneous AMM spot price is movable within a single transaction, so the collateral valuation can be inflated and deflated atomically by the same caller. This is the textbook spot-oracle failure.
4/
The attack — tx 0x414b5b7c832b67dcd0c3f16907c8702ff794ce9dd0b749d0100e7549ba202d49 (a contract-cr
September 6, 2026 21 4
