Decentralized exchange (DEX) Osmosis has lost around $5 million in tokens after attackers exploited a liquidity provider (LP) bug that emerged after its recent update, the DEX said in a series of tweets.
According to the announcement, the bug allowed users to add liquidity to any Osmosis LP and then withdraw them instantly for a 150% return on their initial investment. The bug was first reported in a Reddit post on June 8, and although it was quickly removed, users were able to use the exploit and drain around $5 million from Osmosis’ liquidity pools.
Liquidity pools were NOT “fully drained”.
The developers fix the bug, determine the size of the losses (probably in the range of about $5 million) and work on the recovery.
Further information follows. https://t.co/WOu7MMgSUM
— Osmosis 🧪 (@osmosiszone) June 8, 2022
The Osmosis team quickly decided to pause the network – which happened at block height 4,713,064 – after the exploit was discovered and determined that it will remain paused for at least 48 hours. The DEX also assured users that any losses from the exploit are covered and that a recovery plan will be available in the near future.
DEX noted on Twitter that the flaw was exploited “intentionally by a small number of users” and “apparently unintentionally by a few others,” with only four individuals identified responsible for 95% of the amount exploited. Osmosis co-founder Sunny Aggarwal said in a post that two of the attackers made a series of transactions on centralized exchanges, making them easier to trace. He also wrote:
“Law enforcement has been notified. We hope the exploiters are doing the right thing here so aggressive action is not required.”
Shortly after Osmosis revealed the bug on Twitter, FireStake admitted that two of its members had exploited the bug for about $2 million after experiencing “a temporary lack of good judgement.” After being “stressed out all night,” the pair decided to come forward and voluntarily return the money.
Learn Crypto Trading, Yield Farms, Income strategies and more at CrytoAnswers
https://nov.link/cryptoanswers
Comments are closed.