Briefing
On May 1, 2023, the Level Finance decentralized exchange experienced a targeted exploit that resulted in the theft of approximately $1.1 million in LVL tokens. The incident stemmed from a critical business logic vulnerability within the LevelReferralControllerV2 smart contract, specifically its claimMultiple() function, which allowed an attacker to repeatedly claim referral rewards within a single epoch. This flaw enabled the malicious actor to drain 214,000 LVL tokens, subsequently swapped for 3,345 BNB, causing a significant 50% devaluation of the LVL token.
Context
Prior to this incident, the DeFi ecosystem has consistently faced a prevailing attack surface characterized by complex smart contract interactions and the inherent risks of novel protocol designs. A common vulnerability class involves insufficient input validation and flawed business logic, often overlooked even in audited contracts. The Level Finance protocol, despite undergoing two security audits in 2023, exhibited a critical gap in its precondition checks, leaving its referral reward mechanism susceptible to manipulation.
Analysis
The incident’s technical mechanics centered on a logic bug within the claimMultiple() function of Level Finance’s LevelReferralControllerV2 smart contract on the BNB Chain. The contract was designed to allow users to claim referral rewards once per epoch; however, it lacked a crucial check to prevent the reuse of an epoch identifier during reward claims. The attacker leveraged this flaw by creating numerous referral accounts and employing flash loans to rapidly increase their reward tier. This preparation enabled them to call the claimMultiple() function multiple times within the same epoch, accumulating unauthorized rewards and ultimately draining approximately $1.1 million in LVL tokens from the protocol.
Parameters
- Protocol Targeted → Level Finance
- Attack Vector → Business Logic Flaw (Repeated Referral Claims)
- Vulnerable Component → LevelReferralControllerV2 Smart Contract ( claimMultiple() function)
- Financial Impact → $1.1 Million
- Assets Stolen → 214,000 LVL tokens (swapped for 3,345 BNB)
- Blockchain → BNB Chain
- Date of Exploit → May 1, 2023
- Token Price Impact → LVL token dropped 50%
Outlook
Immediate mitigation involved Level Finance temporarily shutting down its referral program and planning a new contract implementation, underscoring the necessity of swift incident response. This exploit highlights the persistent contagion risk for similar protocols employing complex reward mechanisms without rigorous validation of state changes and precondition checks. The incident reinforces the need for enhanced security best practices, including continuous on-chain monitoring for anomalous transactions and the adoption of formal verification methods beyond traditional audits to identify subtle business logic flaws that can lead to significant financial loss.
