Briefing
Decentralized exchange Level Finance suffered a targeted exploit on its Referral Controller Contract, resulting in the theft of over $1 million in its native LVL token. The primary consequence was the unauthorized draining of 214,000 LVL tokens, which the attacker immediately swapped for 3,345 BNB on the Binance Smart Chain. This incident was directly facilitated by a critical logic flaw in the contract’s claim multiple function, which failed to prevent repeated claims from the same period.
Context
The DeFi sector remains highly susceptible to logic-based smart contract vulnerabilities, especially in auxiliary features like referral and incentive programs that often receive less audit scrutiny than core trading logic. Prior to this event, the prevailing attack surface involved unaudited or insufficiently validated external-facing functions, creating an open port for attackers to manipulate state variables and bypass intended economic controls. This specific vulnerability falls within the known class of flawed access control and state management within non-core contracts.
Analysis
The attack vector exploited a critical logic flaw in the LevelReferralControllerV2 smart contract’s claim multiple function. The attacker repeatedly called this function, which failed to properly track or invalidate previous claims for the same period, effectively allowing the unauthorized minting and withdrawal of LVL tokens. This loop of repeated claims enabled the attacker to siphon 214,000 LVL tokens before the protocol team was able to temporarily shut down the referral program, isolating the exploit from core liquidity pools and the DAO treasury. The success of the attack was due to insufficient input validation and state management within the contract’s claim mechanism.
Parameters
- Total Funds Drained → $1.01 Million → The estimated market value of the 214,000 LVL tokens stolen and immediately swapped for 3,345 BNB.
- Vulnerable Contract → Referral Controller V2 → The specific smart contract containing the flawed claim multiple function that allowed repeated claims.
- Attacker’s Swap → 3,345 BNB → The final asset the attacker converted the stolen LVL tokens into on the BNB Chain.
- Protocol TVL Change → $8.5 Million Reduction → The drop in Total Value Locked (TVL) from $41 million to $32.5 million following the incident.
Outlook
Immediate mitigation requires a full audit and redeployment of the referral contract with rigorous state-checking mechanisms to prevent all repeated claims. Similar DeFi protocols utilizing complex incentive or vesting contracts must immediately conduct internal reviews of all claim functions for potential logic flaws, as contagion risk is high for this class of vulnerability. This incident will likely establish new security best practices mandating a dedicated, independent audit for all non-core but token-interacting contracts, prioritizing function-level access control and state validation.
Verdict
This exploit underscores the critical systemic risk posed by logic flaws in auxiliary smart contracts, proving that non-core protocol features remain a primary vector for significant capital drain.
