Level Finance [LVL] confirms $1 million exploit due to bug


  • An attacker stole more than $1 million of Level Finance’s native Level Finance [LVL] token.
  • Euler Finance ($197 million stolen) and Sentiment ($1 million stolen) are two of the year’s most notable hacks.

Level Finance, a decentralized exchange, witnessed a security compromise on 1 May, allowing an attacker to steal more than $1 million of the platform’s native LVL token.

Level Finance alerted its 20,000 Twitter followers that over 214,000 of the exchange’s LVL tokens had been stolen and exchanged for 3,345 Binance Coin [BNB], with a market worth of around $1.01 million.

 

Level Finance: How the hack took place

Level Finance’s “LevelReferralControllerV2” smart contract featured a fault that allowed for “repeated referral claims” from the same period, according to blockchain security startup Peckshield. The exchange also verified this in a later statement on Discord.

The v2 controller contract has received multiple calls to the “claim multiple” function within the last 48 hours, according to data from Binance chain explorer BSC Scan.

As of now, the contract’s implementation does not appear to have changed after the attack. However, Level Finance stated that it would release a fresh implementation of the referral contract within the following 12 hours.

The exchange also stated that the hack had no effect on its liquidity pools or connected DAOs.

According to DeDotFiSecurity, the team has temporarily shut down the referral program, effectively ending the attack.

Level Finance announced on Discord that the issue has been isolated from other exploits and that exchange users should “stand by for a full postmortem.”

DeFi attacks continue in 2023

Level finance is a permanent market that is decentralized and non-custodial. The platform, built on BNB Chain, now has a TVL of $32.5 million. It had a TVL of around $41 million prior to the attack.

Level Finance claims to offer programmable pools of liquidity, efficient capital hedging, and risk management, among other things. The network’s utility token, the LVL token, incentivizes adoption across the entire ecosystem.

Source: https://ambcrypto.com/level-finance-lvl-confirms-1-million-exploit-due-to-bug/