Lava Hack
What happened
On March 28, 2024 (UTC), LavaLending, a lending protocol on Arbitrum that let users lend, borrow and lever liquidity positions, lost about $340,000 in a single flash-loan transaction. The attack went through a wrapped Uniswap V3 USDC/USDC.e liquidity-position token that the lending pool accepted as collateral. The exploiter's wallet received 77,477 USDC, 96,215 USDC.e, 8.5 wstETH and 60,349 USDT, and CertiK also listed 20.3 ETH among the stolen funds, sent to 0xfbcdb6ceca13b0e2ca51e86c94d78faab10a6428.
Lava paused all lending markets within about 15 minutes of the report, asked major exchanges to block the exploiter from cashing out, and filed law-enforcement reports within an hour. It offered to stop pursuing the attacker if 90% of user funds were returned and set up a compensation plan for affected addresses from its insurance fund, independent of any return. Lava's post-mortem fix, as quoted in a case study, changed the wrapper's _limitFees function to limit fees even when they are generated in only one token, and made a second compound call in the same block claim pending fees as protocol fees.
- Exploit transaction:
0xcb1a2f5eeb1a767ea5ccbc3665351fadc1af135d12a38c504f8f6eb997e9e603 - Exploiter:
0x851aa754c39bf23cdaac2025367514dfd7530418 - Exploit contracts:
0x3e52c217a902002ca296fe6769c22fedaee9fda1,0x42fae47296b26385c4a5b62c46e4305a27c88988
How it happened
- The attacker's contract took flash loans of WETH, USDC and USDC.e from Balancer, Uniswap V3 pools and Aave.
- Using WETH as collateral, a helper contract borrowed about 99% of the wrapped USDC/USDC.e LP tokens held by the lending pool.
- The attacker made a large one-sided USDC.e-to-USDC swap in the Uniswap V3 USDC/USDC.e pool that backs the wrapper, then withdrew and re-deposited LP positions into the wrapper at the skewed pool state.
- The new LP shares and WETH were deposited as collateral, and a second contract used that collateral to borrow the full available balance of USDC.e, USDC, USDT, WETH and wstETH from the pool.
- The attacker swapped back, repaid the flash loans and kept about $340,000.
Protocol details
Evidence
- report @CertiKAlert incident report twitter.com
- report @LavaLending incident report twitter.com
- report CertiK Alert on LavaLending (via fxtwitter API) x.com
- report LavaLending update 4 on compensation (via fxtwitter API) x.com
- report BlockSec Phalcon alert (via fxtwitter API) x.com
- transaction Arbiscan transaction 0xcb1a2f5e...e603 arbiscan.io
- address arbiscan.io address 0x3e52…fda1 arbiscan.io
- address arbiscan.io address 0x42fa…8988 arbiscan.io
- address arbiscan.io address 0x851a…0418 arbiscan.io
- address arbiscan.io address 0xfbcd…6428 arbiscan.io
- code DeFiHackLabs LavaLending_exp.sol (2024-03) github.com
- analysis DeFiLlama defillama.com
- analysis Mar 2024 - Lava Lending Flash Loan Attack - $340k quadrigainitiative.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
