Assets Removed from Osmosis
On June 8th, a critical bug was found on Osmosis that led to the theft of several million dollars from liquidity pools. In an effort to help provide the Osmosis team with important data, we’ve curated these flash bounties to surface metrics that the team has requested. The upgrade that contained the exploited bug occurred at block height 4707300, and the chain was halted at block 4713064.
The issues that would be addressed in this dashboard;
-
What was the total dollar amount of assets that was improperly removed from pools due to the bug, and what is the list of addresses that had joined a pool since the upgrade?
-
What is the dollar value deposited of those addresses joining pools?
-
What is the cumulative value of funds that joined and exited?
Method
Two activities jumped out at me when I looked through the table of osmosis core.fact liquidity provider actions. I proceeded to join Pool, but by the time I got there, Pool had already left. After that, I joined the osmosis.core.dim labels community in order to learn about tokens.
As a result, I made it a point to keep an eye out for anything that seemed out of the ordinary. At first, I checked to make sure that the sum of all the additions and subtractions that were equivalent was correct. Is there a cap on how long they can serve in that capacity? Amounts in US dollars that have been added and deleted from the account.
- The total amount of money in US dollars that was taken out of Osmosis amounts to 14.5 million dollars.
- The Above and following chart presents, in US Dollars and amount of assets, the total volume that was either added or deleted from each wallet. Osmosis traffic was most heavily concentrated at two different addresses. The largest sum of newly added liquidity is 6 million dollars, which was contributed by two different addresses. The biggest amount of volume that was eliminated was worth 9 Million and 4 Million Dollars.
-
This two PIE charts in the above and below, allows us to identify the assets that were previously added and removed from those wallets. The Top Users took off with 7.3 million dollars worth of Osmosis, 3.4 million dollars worth of Cosmos, and 2.2 thousand dollars worth of USDC.
-
and according the following chart, The Top Users added assets on 4.87 million dollars worth of Osmosis, 2.27 million dollars worth of Cosmos, and 1.53 thousand dollars worth of USDC.
-
The above chart provides a summary of the total number of items and quantities in US Dollars. Similar to the last data, more than 13.4 million dollars were taken out at one in the morning on June 8th.
-
As well as the total number of added liquidities, in the following chart, The most of the action took place between midnight to two in the morning. At one thirty in the morning on June 8th, more than 9 million dollars were added.
Conclusion
It would appear that the attacker altered the quantity of liquidity by adding and deleting Osmosis, Cosmos and USDC Tokens from circulation. In addition, it would appear that they first came upon the insect, and then, after a few hours had passed, they returned to the scene of the crime to add a sizeable amount of liquids.