Likwid exploit on BNB Chain: 74 BNB lost to an unassigned pairDelta
A vulnerability in the Likwid margin trading protocol on BNB Chain left the pairDelta field unassigned in the leverage=0 branch, so pair reserves never updated. The attacker borrowed 14 times at the same stale price and drained 74.31 BNB.
- The leverage=0 branch never assigned pairDelta, leaving pair reserves unchanged
- The attacker repeated the cycle 14 times, each time getting the same 4.7857 BNB quote
- About 211.8M TOKEN was settled at the stale price, draining 74.31 BNB
- The vault's reserve consistency check passed throughout the attack
Read next
Security