Cozy Finance Drained Again: $170K Lost to a UMA Oracle Manipulation

Cozy Finance, a DeFi protocol that sells coverage against failures in other protocols, lost roughly $170,000 on Optimism on September 7, 2026. The mechanism wasn't a reentrancy bug or a leaked key — it was the oracle that decides whether a covered event actually happened.

What happened

Blockaid flagged the exploit transaction at 05:43 UTC. The attacker moved out roughly 163,326 USDC.e across 63 transfers and burned about 1.6 million Cozy PToken (CPT), routing the proceeds through a bridge by 05:56 UTC — 13 minutes start to finish, faster than Blockaid's alert could translate into a response. The attack contract had been sitting live since September 2, funded via a Relay solver, suggesting the exploit was planned days in advance rather than opportunistic.

The oracle trust gap

The drain ran through an unverified contract called Cozy Set (CSET), which still held about $4,168 in USDC.e after the attack. Reporting on the incident describes the attacker submitting a false assertion to Cozy Finance's UMA Optimistic Oracle integration that went unchallenged inside its dispute window — triggering a compensation payout the attacker then redeemed. UMA's optimistic-oracle model treats an asserted answer as true unless someone disputes it in time; when nobody watches that window, assert → wait → redeem becomes a three-step attack against real money, with no smart-contract bug required at all.

Déjà vu, different attack surface

This is Cozy Finance's second Optimism-side loss. In August 2025, the protocol lost about $427,000 after security firm Verichains traced the flaw to withdrawal code that never checked who was completing a redemption. That was a permissions bug in the protocol's own logic. This one lived in the oracle-resolution path instead. Different root cause, same lesson: a DeFi insurer's payout logic is its highest-value attack surface, and every route into it — core contract or auxiliary, audited or not — needs the same level of scrutiny.

What this means for oracle-dependent protocols

• Dispute windows need active, automated monitoring — a human noticing a bad assertion after 13 minutes is already too late.
• Auxiliary or 'unverified' contracts sitting next to core logic (like CSET here) should get the same review depth as the flagship contracts, since they can still move real funds.
• Optimistic-oracle integrations are a distinct threat model from classic smart-contract bugs and deserve their own line item in a protocol's security review, not just a general audit checkbox.
• Bridging speed means on-chain circuit breakers or pausable payout paths matter more than incident-response runbooks once funds can leave the source chain in minutes.

Cozy Finance still ranks around fifth among insurance protocols on DefiLlama with roughly $1.3 million in TVL — a reminder that even small, niche DeFi protocols are worth automating an attack against if the payout logic has a soft spot.