An error in the "Immediate or Cancel" order resulted in a loss of nearly $700,000 from Lifinity's LFNTY-USDC pool.
On December 8th, an arbitrage bot drained the LFNTY-USDC pool on Lifinity's decentralized exchange (DEX). According to information published in the Lifinity Discord channel, an unexpected reaction to an unsuccessful trade led to a loss of $699,090.
The main participant in Lifinity, known as Derden, explained that the bot attempted an arbitrage trade through the USDC > xLFNTY > LFNTY > USDC route, trying to profit from price differences between different trading pairs.
The bot placed a "Immediate or Cancel" (IOC) market order on Serum v3 - this is a type of order that, when executed, should be immediately filled at the current market price. Orders that cannot be immediately executed are automatically canceled.
The erroneous transaction resulted in updating the price of the last trade to zero, making the starting price also zero. However, the actual price remains different from zero, but the low starting price caused an immediate fund leakage.
Lifinity v1 is an automated market maker (AMM) that uses algorithms to provide liquidity in trading pairs. According to Derden, to maintain a balance of tokens in the liquidity pool, it uses the Constant Product Market Maker (CPMM) model, a specific type of AMM.
Other decentralized exchanges, such as Uniswap and Bancor, also employ this model. Lifinity v1 does not support the standard Constant Product (CP) curve used in traditional AMMs, but it can effectively emulate its function. One of the methods used for this emulation was modifying the "last price" to set the next initial price. However, due to the error leading to a zero price, the bot was able to exploit this inconsistency and cause a fund leak.
The Lifinity team is working on restoring liquidity to the pool, conducting protocol code checks, and making efforts to recover the lost funds. Currently, transactions with zero sums are no longer accepted.
