Key Takeaways:
- Levana Protocol suffered an exploit after an attacker succeeded in draining approximately 10% of its liquidity pools.
- Decentralized finance startup Levana Protocol’s security exploit, resulting in a loss of $1.14 million.
The Levana perpetual swap protocol, operating on the Osmosis blockchain, recently encountered a significant setback as it fell victim to a severe exploit. Unfolding over a 13-day period, an unauthorized party managed to drain more than $1.1 million from Levana’s liquidity pools.
This exploit resulted in the loss of 10% of the protocol’s liquidity, marking a challenging episode for the decentralized perpetual trading platform.
The incident, detailed in a post-mortem report by the Levana team, unfolded between December 13 and December 26. The attackers exploited a congestion attack on the Osmosis chain, impeding Levana users’ ability to interact with the markets.
This was compounded by a bug in the fee market code of Osmosis and “price staleness” in Levana’s integration with the Pyth oracle, providing an avenue for attackers to manipulate prices and drain the pools.
Levana clarified that the attacker initially drained approximately 4% of its liquidity providers, escalating to an additional 5% before the protocol was closed to new positions. The project identified the incident as an “oracle attack,” confirming that the issue has been addressed, and user positions and profits remain secure.
Founded in 2021, Levana Protocol is designed to facilitate leveraged positions for cryptocurrencies through a decentralized perpetual trading protocol. In response to the exploit, Levana has taken swift action to rectify the breach.
The team is actively developing a comprehensive solution set for deployment in an upcoming update across all chains hosting Levana, including Osmosis, Sei, and Injective. This update is designed to enhance the protocol’s resilience against similar vulnerabilities in the future.
While Levana has temporarily halted new position openings and modifications to existing ones, users have been assured that existing trade positions and profits remain unaffected. The team emphasizes its commitment to safeguarding user assets and restoring full functionality as quickly as possible.
As part of their remedial measures, Levana plans to compensate affected liquidity providers through an airdrop and the distribution of collected protocol fees during the attack period. This approach aims to mitigate the impact of the exploit on the community and reinforce confidence in the Levana Protocol’s security and reliability.
