Blockchain-based perpetual futures swap protocol Levana said on Wednesday that it had suffered an exploit that resulted in the loss of around $1.1 million worth of cryptocurrency tokens from its liquidity pools.
According to the administrators, the Posted On X, formerly Twitter, the incident represented a significant setback for the protocol, depleting about 10% of reserves. It affected seven wallets that were found to be connected to an oracle. This is a system used by blockchain protocols to connect to external systems and allow them to trigger based on real-world inputs.
Levana is a type of blockchain-based financial market that allows users to trade “perpetual” derivative futures assets, allowing traders to speculate on the future price of the assets without an expiration date. Unlike traditional futures contracts, where the expiration date is fixed, perpetual futures can be held indefinitely. Traders can swap these assets between each other to earn profits, and it requires the protocol to maintain liquidity pools of cryptocurrency tokens for withdrawals.
According to a Autopsy of the attackThe administrators said that the attacker took advantage of the congestion on the Osmosis blockchain when the market was under high stress, which was artificially created through an exploit. This allowed the hackers to manipulate prices, which enabled the exploit. According to Levana, a A bug in the Osmose fee market code meant that during times of congestion, “the gas price provided was generally insufficient to complete trades or conduct ongoing bot maintenance activities.”
Levana said the attack took place between December 13 and December 26. During this time, the congestion prevented normal customers from making transactions and the protocol's bots were unable to interact with its oracle called Pyth, allowing the hackers to carry out an attack that allowed them to empty the liquidity pools.
The team emphasized that Pyth was a central part of the attack, but there was no known vulnerability in it. “It behaved exactly as expected,” said the Levana team.
In addition to the attack, the team said the protocol was previously subjected to a distributed denial of service attack daily from December 17th to December 26th. This meant that a significant portion of the Levana engineering team was dedicated to dealing with this attack, which caused instability on the platform.
“It is unclear whether there is a connection between the congestion attack and this series of DDoS attacks,” the team said. “It is common for DDoS attackers to use the DDoS attack as a distraction from a more insidious attack.”
Existing trader positions and profits will be unaffected and will remain open or may be closed, the team said. However, opening or modifying existing positions has been stopped until an update next week. And since open positions have been stopped, existing deposits are not at risk from the exploit.
The vulnerability exploited by the attackers has been fixed, Levana said, and the team is currently testing it. All liquidity providers affected by the exploit during the attack window will also receive a refund. “Our main focus now is to bring the protocol back online as quickly as possible and to gain key insights from the multi-stage sequence of the exploit,” Levana said.
Crypto protocols, exchanges and companies were major targets of exploits and hackers in 2023. According to statistics from De.FI, the Web3 security company that runs the RIGHTS database, Hackers have stolen around $2 billion worth of cryptocurrencies in dozens of cyberattacks this year. Some notable hacks are included above $100 million stolen from major cryptocurrency exchange Poloniex in November, 50 million dollars taken from the decentralized finance protocol Curve Finance and fast $200 million stolen from Euler Finance.
Image: Pixabay
Your support is important to us and helps us keep the content FREE.
Clicking below supports our mission of providing free, comprehensive and relevant content.
Join our community on YouTube
Join the community of more than 15,000 #CubeAlumni experts including Amazon.com CEO Andy Jassy, Dell Technologies Founder and CEO Michael Dell, Intel CEO Pat Gelsinger, and many more luminaries and Experts.
“TheCUBE is an important partner in the industry. You guys are truly a part of our events and we really appreciate you coming and I know people also appreciate the content you create” – Andy Jassy
THANKS
Learn Crypto Trading, Yield Farms, Income strategies and more at CrytoAnswers
https://nov.link/cryptoanswers