Cozy Finance Lost About $160,000 After an Undisputed Answer to UMA's Optimistic Oracle Faked a Protection Trigger

What happened

Cozy Finance offers protection (insurance-like) products for DeFi. Users buy PTokens against the failure or compromise of a specific protocol and are paid in USDC if the covered event occurs. Whether it occurred was determined by UMA's Optimistic Oracle.

According to SlowMist's record, Cozy Finance on Optimism lost about USD 160,000 on 2026-09-07 (roughly JPY 24.4 million at 152.27 JPY/USD, Google Finance, 2026-09-13). The reported sequence: the attacker bought PTokens in the protection markets covering Aave v2 and Curve, then submitted a "YES" answer to UMA's Optimistic Oracle claiming the covered event had happened. No one disputed the assertion, so it settled. Once the markets moved to TRIGGERED, the attacker burned the PTokens and claimed USDC.

No official post-mortem from Cozy Finance could be found at the time of writing. What follows treats SlowMist's technical analysis as the closest available source and reasons from the publicly documented properties of the mechanisms involved.

What was missing

Two gaps are identified. The trigger did not independently verify that an attack had actually occurred at Aave or Curve, and PToken payout eligibility was not tied to a snapshot of holders taken before the assertion was proposed.

Neither looks dangerous on its own. An optimistic oracle is by definition a mechanism that treats an assertion as true if no one disputes it within a window, so the absence of independent verification is arguably the design working as specified. And if a protection token trades freely, holders change all the time.

The danger is the combination. If truth is settled purely by the absence of a dispute, and eligibility is determined by who holds the claim afterwards, an attacker can lock in profit by buying the claim first and then asserting the loss. It is the equivalent of buying a policy, reporting a fire that never happened, and collecting because nobody said otherwise.

Worth stressing: UMA did not malfunction. An optimistic oracle presumes that someone with an economic incentive will challenge a false assertion, and under that premise it behaved correctly. That no challenge came is a market question, not a technical one. This is structurally identical to other oracle failures — such as price manipulation against a single spot-price source. An oracle is not a device that delivers truth; it is a bundle of preconditions under which a value may be believed, and failures happen where those preconditions do not hold.

Did the economics of disputing actually hold?

The safety of an optimistic oracle reduces to one inequality: if what an attacker gains from a false assertion exceeds what a disputer earns for challenging it, the attack is worth the difference. A disputer must spot the falsehood, post a bond, wait out the challenge period and win the final adjudication before being paid anything. The attacker gets paid the moment the assertion settles. The expected values are not symmetric.

That asymmetry gets worse as the target gets smaller. If a protection market holds a few hundred thousand dollars, there is no economic reason for a professional watcher to sit on it. Anyone building on this mechanism needs to answer "who is watching" with actual names; if the answer is "someone in the community," the market is unwatched.

A related point is the distance between the data used to adjudicate and the thing it describes. The covered events here were incidents at Aave v2 and Curve — external protocols that Cozy's own contracts cannot observe directly. Products conditioned on the state of an external protocol necessarily depend on somebody's assertion. Which is precisely why the design on the receiving end — snapshots, and verification by someone other than the asserter — is the only line of defence there is.

Pitfalls to watch

First, the safety of an optimistic oracle scales with attention on the market in question. Thin markets, dormant markets and liveness windows that open overnight or at a weekend are all likely to have no watcher. The smaller the protocol, the weaker the premise. If you use one, the test is whether you can write down, market by market, whether the dispute bond is large relative to the potential payout and who exactly has an incentive to dispute.

Second, an eligibility snapshot is close to mandatory for insurance-like products. Without a constraint that only holders from before the assertion can be paid, the claim itself becomes an asset acquirable after the fact. The same issue recurs in governance voting (buying up after a proposal), airdrop eligibility and liquidation protection — anywhere value jumps across a state change.

Third, where trigger conditions are written in natural language, interpretive ambiguity becomes attack surface. Optimistic oracle participants read words. If the condition is as coarse as "was there an attack on Aave," the line between an attack and an ordinary loss is left to a would-be disputer's judgement, which raises the cost of disputing. Conditions that are hard to argue about are conditions where disputes do not arrive.

Fourth, do not dismiss this because the loss was small. USD 160,000 marks the lower bound at which the attack is economically worthwhile. If a market with the same design holds a larger balance, the same sequence applies unchanged. Line up the incidents disclosed over recent weeks — spot-price references, feed deviation thresholds, and now an optimistic oracle — and the target is visibly widening from "is the price right" to "is the determination right." Price feeds have accumulated standard defences such as TWAPs, multiple sources and circuit breakers; event-determination oracles have no equivalent canon yet.

Fifth, protection products only move during an incident. Because no payout occurs in normal operation, the payout path gets little testing, and the attacker ends up being the first party to exercise it. The longer a payout path goes unused, the fewer chances there are to validate it. Without a routine that periodically exercises trigger conditions and payout paths in production, defects of this kind surface for the first time during the event they were built for.

[Technical Insights & Actions]

1. An optimistic oracle does not confirm truth; it treats the unrefuted as true. That premise fails automatically in markets nobody is watching. If you depend on one, what you depend on is not a technology but a market condition — the presence of a third party willing to dispute. [Protocol engineers] This month, tabulate every market you run on an optimistic oracle with its maximum payout, dispute bond, liveness window and the actual parties monitoring it, and flag markets where payout dwarfs bond.
2. Any claim whose value jumps across a state change invites post-hoc arbitrage unless eligibility is snapshotted before the act of asserting that change. The principle covers payouts, governance votes, liquidation protection and conditional rewards alike. [Contract developers] Before your next release, verify in code that payout, voting and reward eligibility bind to state at or before proposal time, and add snapshotting where they do not.
3. As long as the trigger condition is natural language, the cost of disputing rises with its ambiguity — and conditions that are hard to argue with are conditions that get attacked. Push as much of the condition as possible onto mechanically observable on-chain facts, such as a balance decrease in a named contract or the emission of a specific event. [Product design] When specifying a new market, test whether the trigger can be expressed as an observable on-chain fact, and cap payouts for conditions that cannot be.

[Sources]

• SlowMist Hacked (incident database, Cozy Finance entry, 2026-09-07): https://hacked.slowmist.io/
• SlowMist Team (@SlowMist_Team), technical analysis (2026-09-07): https://x.com/SlowMist_Team/status/2096881310237426062

This article is a technical commentary based on publicly available information and is not investment advice. No official post-mortem from Cozy Finance was available at the time of writing; the description of the attack path relies on third-party analysis.