Attacker exploited Lever's liability calculation to execute a flash loan attack using two malicious contracts. Contract A borrowed 2,100 BNB and deposited 2,000 into Lever's vault for interest-bearing tokens, then borrowed 1,500 BNB. Contract B received the collateral without Lever verifying that the xWBNB wasn't already used as collateral, allowing repayment with uncollateralized borrowed funds.

Lever, a decentralized margin trading protocol based on AMM, was attacked by lightning loans. According to the official statement, Lever attacked contract A to borrow 2,100 BNB from PancakeSwap and deposit 2,000 BNB into Lever’s BNB vault. Then borrowed 1500 BNB from Lever’s BNB vault and transferred it to Lever Attack Contract B. Lever Attack Contract B deposited 1500 BNB and used it to consume 32.78 ETH, 1,068.05 BAKE, 167.25 XVS, 1,042.89 DAI, 674,360 USDT. BTC , 1,930.01 CAKE, 463.0078 DOT and 332.9184 WBNB. (Calculated at the current market price, the total loss is equal to US$652,941.949.)