Injective exploit drains $4.9M through market settlement logic

Injective reportedly lost about $4.9 million after an attacker abused market creation and settlement logic connected to a self-controlled oracle and refund path. The incident shows how dangerous it can be when a protocol lets one actor define too many critical parameters for a new market.

The vulnerability class is not a simple key theft; it is a design flaw in how market identity, oracle trust, and settlement rules interact. If a protocol allows a user to create a market, control its price source, and influence its expiration or refund behavior, the system can be steered into paying out on manufactured conditions.

This is reusable against other derivatives or betting systems that expose flexible market setup without strong validation. Defenders should require hardcoded or reviewed oracle sources, separate permissions for market creation and settlement, and sanity checks that reject economically nonsensical parameter combinations.

The incident also reinforces the need for limits on how much value can be placed behind a newly created instrument before it has been independently reviewed. Security controls should focus on preventing attacker-defined markets from ever reaching meaningful size.