Lever Hack

The attacker:

Address 0x1bd2…f76b

The transaction behind the attack:

Tx 0xb536…5593

Attack contract A:

Address 0x5f92…3f4e

Attack contract B:

Address 0x3790…8e1e

Steps:

• Attack contract A flash loaded 2,100 BNB from PancakeSwap and deposited 2000 BNB on Lever’s BNB vault
• Borrowed 1500 BNB from Lever’s BNB vault and transferred it to Lever attack contract B
• Attack contract B deposited 1500 BNB and used it to drain 32.78 ETH, 1,068.05 BAKE, 167.25 XVS, 1,042.89DAI, 64,157.79 BUSD, 54,335.19USDT ,2.8806 BTC, 1,930.01CAKE, 463.0078DOT, and 332.9184 WBNB
• The total loss equals $652941.

Attack contract A used attack contract B’s 1500 xBNB (which had been collateralized to borrow other assets) to repay the 1500 dBNB it borrowed, by calling the repay() function in the MarginPool.sol contract.

The contract didn’t check the liabilities of the caller. The attack contract B was able to repay the attack contract A’s dtoken with its xtoken. The attack contract A repaid the flash loan on PancakeSwap.