Lifinity USDC pool flowed by arbitrage bot

Decentralized exchange (DEX) Lifinity floated its LFNTY-USDC pool on December 8 with an arbitrage bot. According to Lifinity's Discord channel, an unexpected response to a successful trade resulted in a loss of $699,090.

According to a Lfinity core member known as Durden, a bot attempted an arbitrage trade following the line USDC > xLFNTY > LFNTY > USDC, trying to profit from price differences between different trading pairs.

Here's how the events unfolded when the @Lifinity_io Discord hit 700k arb

I noticed something wrong with the LFNTY price and alerted Zoro, one of the devs on the forum.

At first glance, the protocol seems hacked pic.twitter.com/ebXfK9pDW3

— Drasho (@DrashoWho) December 8, 2023

The bot has launched an Instant or Cancel (IOC) market order on Serum v3, this order type should be executed immediately at the current market price if filled. Orders that cannot be filled immediately are cancelled.

But instead of returning an error, it returned a size of 0, as most programs do. Our pools have processed 0 amounts and returned 0 amounts. Durden said before explaining that the program has improved the final transaction price. to 0, making the next starting value also 0. “Because it's a CP curve, the actual value is not going to be 0, but the pool offered a very low price, which immediately led to a drain.”

Lifinity v1 is an Automated Market Maker (AMM), meaning it uses algorithms to create liquidity in trading pairs. According to Durden, it relies on a Constant Product Market Maker (CPMM), a specific AMM model, to balance between two token sizes in the liquidity pool.

Other decentralized exchanges like Unisawp and Bancor use this model. Lifinity v1 does not support the standard constant product (CP) curve used in traditional CPMMs, but can replicate the function. One of the solutions used to iterate over it is to call the “end value” function to the next starting value. However, since the error returned a value of 0, the bot was able to use the exception to destroy the money.

Cointelegraph reached out to the Lafinity team and did not receive an immediate response. A community member on X (formerly Twitter) pointed out that the incident was not the result of an attack.

The Lifinity team is working to introduce liquidity to the pool while reviewing the protocol code and trying to find funds. Transactions that result in 0 amounts are not accepted.

Magazine: Exclusive — 2 years after John McPhee's death, widow Janice is broken and needs answers.