On December 8, the decentralized exchange (DEX) Lifinity experienced a major loss when its LFNTY-USDC liquidity pool was drained by an arbitrage bot. The bot executed a trade route of USDC > xLFNTY > LFNTY > USDC, aiming to capitalize on price differences between these trading pairs.
The bot initiated an Immediate-or-Cancel (IOC) market order on Serum v3. This type of order is designed to execute immediately at the current market price or be canceled if it can't be filled. However, instead of returning an error for an unfillable order, the system erroneously returned a zero amount out. This unusual response led the software to set the last transaction price and the subsequent starting price to zero, offering an abnormally low price and resulting in the pool being drained.
Lifinity v1 functions as an automated market maker (AMM), utilizing algorithms to maintain liquidity in trading pairs. It operates on a constant product market maker (CPMM) model, aiming to balance token quantities in a liquidity pool. Although Lifinity v1 doesn't support the traditional constant product (CP) curve used in standard CPMMs, it replicates this function. The bug exploited by the bot was linked to a "last price" function, which, due to returning a zero price, allowed the bot to drain the pool's funds.
Disclaimer: Please note that the information provided in this article is based on the referenced research articles. It is essential to conduct further research and analysis before making any investment decisions. The cryptocurrency market is highly volatile, and investors should exercise caution and consult with financial professionals before engaging in cryptocurrency trading or investment activities.
