Secured Finance Lending

getMarketUnitPrice() derived its price from blockTotalAmount / blockTotalFutureValue for orders filled in the current block, allowing attacker-controlled trades to push the reported price near par. The resulting inflated lend position was accepted as collateral, enabling assets to be withdrawn from the lending pool.

A block-reliability check did not prevent manipulation performed atomically with flash-loaned liquidity.