What happened
Beginning December 13, 2023, attackers drained more than $1.1 million, or about 10% of Levana's Osmosis liquidity pools, over 13 days. Levana attributed the exploit to chain congestion and an Osmosis fee-market bug that contributed to price staleness in Levana's Pyth integration; Levana said Pyth itself behaved as expected.
How it happened
- Attackers created congestion on Osmosis that impaired normal Levana market interaction.
- An Osmosis fee-market bug left the gas price insufficient for ongoing market and bot-maintenance activity during congestion.
- Price staleness in Levana's interaction with Pyth then enabled price manipulation that drained the pools over 13 days.
Protocol details
Classification
Protocol Logic / Oracle Manipulation
Protocol Type
Derivatives
Implementation language
Rust
Protocol links
Website
@Levana_protocol
Security review history
- PeckShield View report
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
