Decentralized exchange (DEX) Level Finance was recently exploited, resulting in hackers stealing roughly $1 million worth of its native token, LVL, from the platform. The exchange took to Twitter to announce the incident, informing its over 20,000 followers that the exploit targeted its Referral Controller Contract.
Buggy Smart Contract
An analysis from blockchain security firm Peckshield revealed that Level Finance’s Referral Controller ContractV2 had a bug that allowed for repeated referral claims from the same epoch. This led to the hacker stealing around 214,000 LVL tokens and swapping them into 3,345 Binance Coins (BNB) worth approximately $1 million. BscScan further revealed that the V2 experienced multiple calls of the “claim multiple” function within the last 48 hours.
Level Finance is yet to change the contract’s implementation but pledged to launch a new referral contract within the next 12 hours. The exchange noted that its liquidity pools and DAO treasury were not impacted.
Level Finance Shuts Down Referral Program
According to a Twitter user dubbed DeDotFiSecurity, Level Finance’s team has temporarily shut down the referral program to mitigate the damage and prevent further exploitation. On Discord, the exchange notified users that the incident had been isolated from other potential attacks. The platform also urged users to “stand by for a full post-mortem.”
The latest attack further highlights the importance of transparent testing and auditing of smart contacts as well as measures taken by industry firms to improve the level of their security. Exploits have continued to be one of the major challenges affecting startups in the crypto sector.
According to recent data compiled by blockchain security firm CertiK, crypto projects lost approximately $103.6 to criminals in April, bringing the total year-to-date (YTD) loss to $429.6 million.
Among the stolen funds in April, the total loss due to exploits amounted to $74.5 million, representing over half of the crypto assets stolen during the month. On the other hand, roughly $19.9 million were lost to flash loan attacks while crypto assets lost to exit scams amounted to $9.4 million.
