Levana Protocol hack — December 2023

Levana ran perpetual swaps on the Osmosis chain. Between 13 and 26 December 2023 attackers extracted about $1.146 million from its liquidity pools, roughly 10% of pool funds, by trading against prices the protocol could not update.

Levana's post-mortem describes three components acting together: its Pyth price feeds tolerated up to 120 seconds of staleness; a bug in the Osmosis fee-market code meant that during congestion the gas price Levana's bots offered was generally insufficient for trades and maintenance to go through; and the attackers themselves congested the chain. With prices effectively frozen, a position could be opened at a stale price and closed after the next update at a guaranteed profit, with the difference paid out of the liquidity pools. Levana stated that the Pyth oracle itself was not vulnerable and behaved as expected.

About 4% of pool value went over the first twelve days and a further 5% on 26 December alone. Levana's own accounting attributes extraction across markets as stATOM-USD $241k, ATOM-USD $229k, BTC-USD $190k, ETH-USD $128k, TIA-USD $108k and about $250k across USDC pairs. Range, analysing the attack separately, identified nine addresses connected to the attack with links to centralised exchange accounts and described the attackers selectively submitting Wormhole price payloads to time updates.

Levana halted new positions and modifications, deployed a fix separating order placement from execution so a position's price is set in a later block, and relaunched after testnet validation. It set up a compensation programme for affected liquidity providers funded by token airdrops and by protocol fees collected during the attack window. The funds were not recovered and no actor has been identified. The Block reported the loss as over $1.1 million, consistent with Levana's figure.