The report identifies Oracle price manipulation as a high‑impact threat with estimated losses of $30M–$80M per attack, driven by a one-block TWAP window on L2s and mixed feeds, with current mitigations like TWAP and feed medians but persistent vulnerability from short windows.

A prioritized set of technical recommendations (P1–P5) advocates extending price finality, strengthening reentrancy protections, enforcing pre‑transaction liquidations and governance delays, implementing dynamic price and risk controls, and expanding security testing across L1/L2 flash‑loan scenarios.

Self‑liquidation via flash loans lets borrowers liquidate their own positions for discounted collateral, with losses estimated at $1M–$3M per event; mitigation includes a discount cap and a waiting period.

Governance flash‑vote attacks exploit token snapshots at block height to gain temporary voting power via flash loans, risking malicious upgrades or parameters; mitigations include a minimum voting period, though snapshot timing remains a risk.

External callback reentrancy poses direct collateral theft risk (potential losses >$10M); while guards exist on many entry points, several hooks still lack nonReentrant protections.

Cross‑chain bridge flash‑mint exploits allow minting wrapped assets in the same transaction, enabling double‑spending with potential losses over $15M; mitigations include delayed finality and optimistic proofs without a challenge window.

The report provides implementation details including code sketches for median price calculations, finality checks, and governance voting power timing, plus suggested bridge and oracle mitigations.

Bitkub stands out as a high‑value DeFi platform with about $1.47B total value locked across Ethereum and Layer 2s (Optimism, Arbitrum, zkSync).

The analysis covers flash‑loan attack vectors in depth, including oracle manipulation, reentrancy via external callbacks, liquidation front‑running and borrow‑and‑reborrow loops, governance voting via flash loans, cross‑chain flash‑mint attacks, AMM sandwich attacks, and self‑liquidation via flash loans.

Sandwich attacks on AMM pools can impact user trades and price feeds, causing losses and oracle distortions without directly compromising protocol assets.

Liquidation front‑running and borrow‑and‑reborrow loops can drain collateral at discounted prices when health factors are manipulated, with estimated losses of $5M–$20M per attack.