Lifinity USDC pool is exhausted due to arbitrage bots.
Decentralized exchange (DEX) Lifinity had its LFNTY-USDC pool exhausted by arbitrage bots on December 8. According to Lifinity’s Discord channel, unexpected responses to failed transactions resulted in a loss of $699,090.
A core member of Lifinity known as Durden explained that the bot attempts to profit from price discrepancies between different trading pairs by attempting arbitrage along the path USDC > xLFNTY > LFNTY > USDC.
Here’s how it happened: @Lifinity_io Discrepancies when 700,000 arbitrage occurs
I discovered there was a problem with LFNTY pricing and alerted zoro, one of the platform developers.
At first glance, it looked like the protocol had been hacked. pic.twitter.com/ebXfK9pDW3
— Chardo (@DrashoWho) December 8, 2023
The bot initiated immediate or cancel (IOC) market orders in Serum v3. This is a type of order that, when filled, must be executed immediately at the current market price. Orders that cannot be processed immediately will be cancelled.
“But instead of returning an error like most programs, it returned a zero amount. Our pool entered a zero amount and returned a zero amount,” Durden noted, before explaining that it prompted the program to update the last transaction price. If set to 0, the next starting price will also be 0. “It’s a CP curve, so the actual price is not zero, but because the pool offered a very low price, there was a multiple right away.”
Lifinity v1 is an automated market maker (AMM). In other words, it uses algorithms to create liquidity in trading pairs. According to Durden, it relies on a specific type of AMM model, the Constant Product Market Maker (CPMM), to maintain a balance between the quantities of two tokens in the liquidity pool.
Other decentralized exchanges such as Unisawp and Bancor also use this model. Lifinity v1 does not support the standard constant product (CP) curves used in traditional CPMMs, but can replicate their functionality. One of the solutions used to replicate this was to call the “final price” function for the next starting price. However, because the bug returned a price of 0, the bot was able to exploit the discrepancy to clear the funds.
Cointelegraph reached out to the Lifinity team but did not receive an immediate response. A community member on X (formerly Twitter) pointed out this incident. It wasn’t Results of the attack.
The Lifinity team appears to be working to reintroduce liquidity to the pool while reviewing the protocol code and attempting to recover funds. Transactions with an amount of zero are no longer allowed.
magazine: EXCLUSIVE — Two years after John McAfee’s death, his widow Janice is broke and needs answers.
