FLASH NOTE: Osmosis Exploited and Halted

On June 7, the Osmosis blockchain halted for emergency maintenance after malicious users exploited a critical bug, and approximately $5 million of liquidity (2.3% of TVL) was drained from the protocol. As a result, users could not utilize the Osmosis DEX or access deposited funds while the chain was halted. A community member discovered the bug and posted the details on the OsmosisLabs subreddit, but the original post was deleted to prevent further exploits.

Just 7 hours after the halt, the dev team announced they had identified and patched the bug. However, the team elected to continue testing the updated codebase, so the chain did not restart until June 12, five days after the halt.

The Exploit

After the v9.0 upgrade, when a user deposited two assets into a liquidity pool, the protocol incorrectly double counted one of the assets and distributed 50% more LP tokens than accurate. LPs could withdraw more assets than they initially deposited because their ownership of the pool was overstated.

The bug affected all new LPs, but a few malicious users exploited the bug by joining a pool, receiving 1.5x more LP tokens, withdrawing 1.5x more liquidity than was initially deposited, and looping the process. Continued exploits could have completely drained the Osmosis liquidity pools.

The Osmosis team took 14 hours to identify four wallets that account for 95% of the exploited funds. One of the attackers was FireStake, a validator for the Cosmos ecosystem chains Sifchain, Provenance, and Evmos (but not an Osmosis validator). FireStake willingly stepped forward to admit their involvement in the exploit and agreed to return the funds to the Osmosis team. Some community members are pleased that FireStake came forward while others believe the group should be punished.

Analysis of FireStake’s wallet shows the attack was cycled 14 times leading up to the chain halt. FireStake began with just $198 of liquidity and ended with $191,000, raking in over a 96,250% gain in roughly 10 minutes. On their final malicious transaction, $128,000 (56,959 OSMO and 64,000 USDC) was added to the OSMO/USDC pool. Just 13 seconds later, $191,000 (85,353 OSMO and 95,526 USDC) was withdrawn.