Lever Network Flash Loan Attack

Notice: This page is a freshly imported case study from the original repository. The original content was in a different format, and may not have relevant information for all sections. Please help restructure the content by moving information from the 'About' section to other sections, and add any missing information or sources you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Lever Network

Despite two audits by CertiK, the Lever Network's smart contract hot wallet was still vulnerable to exploit due to a missing check. The funds were taken from the hacker. Because there wasn't an extreme amount of loss, the team was able to reimburse the loss from their own wallets.

This is a global/international case not involving a specific country.

About Lever Network

"Lever is the first AMM-based decentralized margin trading platform on multi-chains, where users can easily earn interest through lending and perform leveraged trading. Powered by its own margin pool and by integrating with external AMM’s like Uniswap, Lever can significantly increase your trade efficiency and asset utilization. With Lever, simplified margin trading and visualized position management are available for traders in the DeFi space."

"Lever is an open-source margin trading platform where you can lend, borrow and perform leveraged trading to either buy long/sell short an asset in just one place. For lenders and/or borrowers, you can lend your idle crypto assets to earn interest or use them as collateral to take out loans. And for traders, after making a margin deposit in the margin pool, you will be able to open either long or short positions in a supported asset in Lever with up to 3x leverage."

"Lever is basically an open-source margin trading platform where we can lend, borrow and perform leveraged trading to either buy long/sell short an asset in just one place. For lenders/borrowers, we can lend your idle crypto assets to earn interest or use them as collateral to take out loans. For traders,after making a margin deposit in the margin pool, we will be able to open either long or short positions in a supported asset in Lever with up to 3x leverage. The platform makes use of external AMMs like Uniswap to provide surplus liquidity."

Lever Finance had two audits from CertiK prior to the attack.

"On Nov-26–2021 06:48:42 PM +UTC, a hacker constructed an attack transaction."

"We are still checking what happened in the past few hours. Please be patient and wait. We will update the community ASAP." "For the security of the protocol, we have temporary paused LEV mining and also removed liquidities in Sushiswap and Mdex . We will bring them back when the time is right."

"#CertiK confirms that a hacker exploited Lever Finance with the flash loan attack on multi-chains."

"The attacker could withdraw a certain amount of various tokens (WETH, UNI, USDT, USDC, 1INCH), along with newly minted the same amount of d-tokens."

"First, the Lever attack contract A flashloaned 2,100 BNB from PancakeSwap and deposited 2000 BNB on Lever’s BNB vault. It then borrowed 1500 BNB from Lever’s BNB vault and transferred it to Lever attack contract B. The Lever attack contract B deposited 1500 BNB and used it to drain 32.78 ETH, 1,068.05 BAKE, 167.25 XVS, 1,042.89DAI, 64,157.79 BUSD, 54,335.19USDT ,2.8806 BTC, 1,930.01CAKE, 463.0078DOT, and 332.9184 WBNB. (The total loss equals $652941.949 at present market price.)"

"The key step is the Lever attack contract A used Lever attack contract B’s 1500 xBNB (which had been collateralized to borrow other assets) to repay the 1500 dBNB it borrowed, by calling the repay() function in our MarginPool.Sol contract." "The contract didn’t check the liabilities of the caller at this step. Thus, the Lever attack contract B was able to repay the attack contract A’s dtoken with its xtoken." "This loophole had been there since the first contract deployment, but was neglected by the team and our third-party auditing partners, until it was exploited by the hacker."

"(1) Borrow 20 WETH from DYDX. (2) Transfer borrowed WETH to Lever interest bearing WETH and get an interest-bearing reward for the owner. (3) 20 xWETH and 15.1 dWETH were minted to SuspiciousContract1 through Lever interest-bearing WETH (xWETH). (4) SuspiciousContract1 withdraw remaining WETH(15.1) from Lever interest-bearing WETH. (5) SuspiciousContract1 transfers remaining 15.1 WETH to SuspiciousContract2. (6) SuspiciousContract2 transferred left 15.1 WETH to Lever interest-bearing WETH contract. (7) 15.1 xWETH and 0.726 dWETH(ITx 22) were minted to SuspiciousContract2 through Lever interest-bearing WETH contract. (8) The above steps were repeated for xUSDC/dUSDC , xUSDT/dUSDT/USDT, xUNI/dUNI/UNI, and x1INCH/d1INCH/1INCH."

"The ETH version is now up and running. We have reinjected liquidity, you can normally use the protocol now. We will bring back the BSC version soon."

As of December 8th, "Lever BSC version is now back online. The reinjection has also been completed. You may now withdraw your deposit or repay your debt. Functions including Lending, Borrowing, Trading & Mining are still temporarily paused till further notice."

"As you may have already known, our protocol was recently hacked. A total of 32.78 ETH, 1,068.05 BAKE, 167.25 XVS, 1,042.89DAI, 64,157.79 BUSD, 54,335.19USDT ,2.8806 BTC, 1,930.01CAKE, 463.0078DOT, and 332.9184 WBNB were stolen from our liquidity pool. While we are trying our best to track the hacker and retrieve the funds, we would also like to put forward our compensation plan for the community."

"In the following days, we will use our own funds to reinject the exact amount of stolen tokens to the liquidity pool. By then you will be able to withdraw your full deposits. With that said, the Lever team will cover your loss. Of course, before we start the injection, we will need some time to fix the loophole and re-audit the contract. So please kindly wait and thanks for your support & understanding."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

Known history of when and how the service was started.
What problems does the company or service claim to solve?
What marketing materials were used by the firm or business?
Audits performed, and excerpts that may have been included.
Business registration documents shown (fake or legitimate).
How were people recruited to participate?
Public warnings and announcements prior to the event.

Don't Include:

Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
Anything that wasn't reasonably knowable at the time of the event.

There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

When the service was actually started (if different than the "official story").
Who actually ran a service and their own personal history.
How the service was structured behind the scenes. (For example, there was no "trading bot".)
Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.

Key Event Timeline - Lever Network Flash Loan Attack
Date	Event	Description
November 26th, 2021 12:00:00 AM	Main Event	Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.

Total Amount Lost

The total amount lost has been estimated at $647,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

Ultimate Outcome

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

What parts of this case are still remaining to be concluded?

Prevention Policies

We recommend at least 2 audits come from independent experts. However, it's important to understand that smart contract hot wallets can never be certain to be completely secure, and it's best to have most funds in cold storage protected by multi-signature authorization.