KyberSwap Elastic hack — November 2023

KyberSwap Elastic, Kyber Network's concentrated-liquidity automated market maker, was drained beginning at 22:54 UTC on 22 November 2023. The attacker took a very large flash loan and used it to push the price in targeted pools into a tick range that held no liquidity, then exploited a double rounding error in the computeSwapStep function. Because the rounding direction was wrong, the contract concluded that the target price had not been reached, skipped the tick-crossing step, and never updated the liquidity figure. A swap crossing a tick in the opposite direction then doubled the pool's base liquidity, letting the attacker withdraw far more than had been supplied. The margin was tiny, defeating an internal check by a fraction of a percent, and the technique was replayed across many low-liquidity pools. Kyber suspended liquidity additions across twelve networks and counted 2,367 affected liquidity providers.

The published figures measure different things. Kyber's post-mortem accounts for $56,197,284 of affected assets, of which approximately $55,234,535 was taken from the pools. The primary exploiter took approximately $48,671,787. Bots that front-ran and mimicked the transactions took approximately $6,562,748 more, and small copycat exploits followed. Kyber's own statement at the time cited approximately $48.8 million, the primary exploiter's share, and that is the number most often repeated; The Block reported $47 million a week later.

Kyber recovered approximately $5.7 million from the front-running bots and a further approximately $706,000 of locked assets, then offered affected liquidity providers treasury grants of 60 percent of the value of unrecovered assets in stablecoins vested over three months, or 100 percent vested over twelve. The attacker separately posted an on-chain message demanding complete control of the Kyber company and its DAO, with a 10 December deadline.