Level Finance Exposes Buggy Smart Contract Flaw Costing $1M

May 1, 2023 - Around 3 mins mins to read

Key Points:

Decentralized exchange Level Finance suffers $1M exploit due to buggy smart contracts.
214,000 LVL tokens drained and swapped into 3,345 Binance Coin.
Smart contract bug allowed for repeated referral claims.

Decentralized exchange Level Finance recently experienced a security breach, which has led to the theft of over $1 million worth of the exchange’s native token, Level Finance (LVL).

As a result, the exchange’s 20,000 Twitter followers were notified that approximately 214,000 LVL tokens had been drained and exchanged for 3,345 Binance Coin. This is a concerning development, as it shows the vulnerability of decentralized exchanges and the need to address security concerns.

An exploit targeted our Referral Controller Contract.

– 214k LVL tokens drained to exploiters address.
– Attacker swapped LVL to 3,345 BNB
– Exploit was isolated from other contracts.
– Fix to be deployed in 12 Hrs.
– LP's and DAO treasury UNAFFECTED.

More details to follow.
— LEVEL Finance #RealYield (@Level__Finance) May 1, 2023

According to blockchain security firm Peckshield, the “LevelReferralControllerV2” smart contract contained a bug that allowed for “repeated referral claims” from the same epoch. This bug was later confirmed by Level Finance in a statement made on Discord. The fact that such a bug was present in the smart contract highlights the importance of proper testing and auditing of code in blockchain applications.

It seems the @Level__Finance's LevelReferralControllerV2 contract has a bug that allows for repeated referral claims from the same epoch. So far 214k LVLs have been drained and swapped into 3,345 BNB (~1M)

Here is an example hack tx: https://t.co/isqHhzFk1Z https://t.co/ikOWx2ezf6 pic.twitter.com/wlr5bFFf0R
— PeckShield Inc. (@peckshield) May 1, 2023

Further information from Binance chain explorer BSC Scan reveals that the V2 controller contract experienced multiple calls of the “claim multiple” function over the past 48 hours. It is unclear how long the attacker had access to the system and how much damage was done before the breach was detected. However, it is reassuring to know that the implementation of the contract does not seem to have been altered since the attack occurred.

Despite the breach, Level Finance assured its users that its liquidity pools and related DAOs remain unaffected. This is a positive development, as it shows that the company has taken steps to isolate the breach and minimize the damage. Nevertheless, the company is taking steps to address the issue and prevent similar incidents from happening in the future. This includes deploying a new implementation of the referral contract within the next 12 hours.

Level Finance security breach is a stark reminder of the importance of security in decentralized exchanges and blockchain applications. It highlights the need for proper testing and auditing of code, as well as the need for companies to take proactive steps to address security concerns. Despite the breach, Level Finance appears to be taking the necessary steps to mitigate the damage and prevent future incidents. It remains to be seen how the incident will affect the company’s reputation and user trust, but it serves as a cautionary tale for the wider blockchain community.

DISCLAIMER: The Information on this website is provided as general market commentary and does not constitute investment advice. We encourage you to do your own research before investing.

Join us to keep track of news: https://linktr.ee/coincu

Annie

Coincu News

Scam Alert