Hack Explained - Levana Protocol

In a recent decentralised finance (DeFi) hack, the Levana Protocol, a blockchain-based platform specialising in perpetual futures swaps, suffered a significant security breach. Levana, known for enabling traders to speculate on asset prices indefinitely without an expiration date, represents a novel and important facet in the DeFi landscape.

Behind the Breach

The breach at Levana Protocol, which unfolded over a 13-day period from December 13 to December 26, led to a significant loss of over $1.1 million, accounting for about 10% of the protocol's liquidity reserves. The complexity and duration of this exploit were notable. Attackers initiated a congestion attack on the Osmosis blockchain, artificially creating market stress. They exploited a vulnerability in the Osmosis fee market code, which during times of congestion, resulted in inadequate gas prices for trades and bot maintenance. This flaw allowed the attackers to manipulate prices and drain the liquidity pools effectively. Despite the Pyth oracle being involved in the attack, it reportedly had no known vulnerabilities and functioned as expected, highlighting the intricate challenges in safeguarding DeFi platforms against sophisticated cyber threats.

The breakdown of the losses amounting to a total of $1.146 million:

• stATOM_USD: $241k

• ATOM_USD: $229k

• BTC_USD: $190k

• ETH_USD: $128k

• TIA_USD: $108k

• *_USDC: $168k + $82k

Lessons from the Incident

The sophisticated nature of this attack, showcases the complex challenges DeFi platforms face. Moreover, this event mirrors a growing trend of security breaches within the DeFi ecosystem. In 2023, the DeFi landscape saw a staggering loss of around $3 billion. But there is hope as the space matures, hopefully measures like Levana's commitment to reimburse impacted liquidity providers through airdrops and sharing of protocol fees, becomes a new standard for the industry which will greatly increase user confidence and drive mass adoption.

---

Rivanorth is a global boutique Web3 cybersecurity company. We specialise in smart contract audits and blockchain security advisory. Visit https://rivanorth.com/ to find out more.

You build the future. We help you secure it.