What happened
On 1 April 2024, OpenLeverage was exploited for roughly $234K–$236K. The attacker opened and liquidated a margin position in a way that caused the borrowing and margin-trade debt to be accounted for incorrectly, then used the liquidation repayment path and a later payoffTrade withdrawal to extract tokens with little or no effective repayment. OpenLeverage paused services and said its insurance, buyback fund, and reserves would cover protocol losses.
How it happened
- The attacker opened a margin trade with a small borrow position.
- They liquidated it through a path that incorrectly accounted for borrow amounts from both borrowing and margin trading.
- The repayment step allowed the position to be closed with minimal repayment.
- In a later transaction, payoffTrade withdrew tokens without the preceding borrow amount being present for repayment.
Protocol details
Classification
Other / Protocol Logic
Protocol Type
DEX
Affected asset / contract
LToken
Implementation language
Solidity
Protocol links
Website
@OpenLeverage
Security review history
- PeckShield View report
Evidence
- report @PeckShieldAlert incident report twitter.com
- transaction Exploit transaction 1 · BscScan bscscan.com
- transaction Exploit transaction 2 · BscScan bscscan.com
- address Attacker address · BscScan bscscan.com
- address Vulnerable contract · BscScan bscscan.com
- analysis DeFiLlama defillama.com
- analysis OpenLeverage Hack Analysis blog.solidityscan.com
- analysis Decentralized Exchange OpenLeverage Has Been Hacked beincrypto.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
