The ORCL5 index token was exploited through a flaw in the tokenAmountOut output calculation, allowing a flashloan-enabled attack to drain approximately $9,925 from the protocol within 11 minutes of vulnerability discovery.

Indexed Finance's ORCL5 Token contract was attacked by a flash loan and lost $9,925. Root cause preliminary analysis is that "calcSingleOutGivenPoolIn()" calculates wrong value of tokenAmountOut.