Levana Protocol

Summary

Levana Protocol is a decentralized perpetual swaps exchange built on Cosmos, whose name is a mnemonic for "Leverage Any Asset." It launched originally on Terra in early 2022, backed by Delphi Labs incubation and working closely with Mars Protocol on borrowing infrastructure, before Terra's collapse in May 2022 forced a pivot. Levana relaunched its perpetuals product as a mainnet beta on Osmosis in July 2022, later expanding to Sei and Injective. Its core pitch was "well-funded perps": a design intended to structurally eliminate the bad debt and insolvency risk that plagues many perpetual futures protocols. In December 2023, however, Levana's Osmosis deployment suffered a slow-motion exploit that drained roughly $1.1 million (about 10% of pool liquidity) over a 13-day window, exposing gaps between the protocol's theoretical safety guarantees and its real-world dependencies on the underlying chain's fee market and oracle freshness.

Design (Mechanism)

Levana's central innovation was making every position "well-funded": rather than allowing traders to open positions whose maximum possible payout is unbounded or only implicitly capped, Levana calculates and locks in the maximum profit a position could realize at the moment it is opened, reserving that amount from the liquidity pool. This is the inverse of most perpetual DEX designs (e.g., GMX-style pools), which let LPs act as the counterparty to all trader PnL with only implicit backstops (funding rates, dynamic fees) to keep the pool solvent. By pre-committing capital to every open position, Levana aimed to guarantee LPs could never be left holding bad debt, and traders could always be paid out in full regardless of price moves.

The liquidity pool was split into two components: a base liquidity token for passive LPs and an "xLP" (locked/leveraged LP) tranche that absorbed more risk/return in exchange for higher yield, aiming to align incentives between conservative and risk-seeking capital providers. Prices for perpetual positions were sourced from Pyth Network oracle feeds. Position management (funding payments, liquidations, "crank" operations to advance protocol state) relied on a permissionless "crank" mechanism that bots or users could trigger for fee rewards, since CosmWasm contracts cannot execute logic on their own without an external transaction trigger. The protocol's native token, LVN, was used for governance and incentive distribution.

Outcome

Levana successfully deployed and operated on Osmosis, Sei, and Injective, becoming one of the more prominent Cosmos-native perpetuals venues in 2022-2023. However, in December 2023 an attacker exploited a combination of vulnerabilities: a bug in Osmosis's fee/gas market meant transaction gas prices were insufficient during periods of chain congestion, which combined with "price staleness" in Levana's Pyth oracle integration to let the attacker execute trades against stale, favorable prices repeatedly over roughly two weeks before the drain was detected. The exploit removed over $1.1 million, approximately 10% of the affected liquidity pool. Levana halted new position openings pending a code upgrade and committed to compensating affected liquidity providers via airdrops and redirected trading fees from the exploit period. As of the last verification date, no further major incidents were found in available sources, but the episode materially undercut the "well-funded, no-bad-debt" value proposition since LPs suffered real, direct losses regardless of the position-level payout guarantee.

Why it worked

• The well-funded design solved a real, well-understood problem (bad debt/insolvency in perp DEXs) with a conceptually clean mechanism: reserve the max payout up front rather than hoping funding rates and liquidations keep the pool solvent after the fact.
• Multi-chain deployment (Osmosis, Sei, Injective) after the Terra collapse showed the team could re-platform quickly and continue development, rather than folding when their original ecosystem died.
• Backing from Delphi Labs and a credible investor set (Arrington XRP, Dragonfly, CoinFund, ParaFi per public reporting) gave the protocol resources and ecosystem credibility during the difficult 2022 bear market.

Where the design broke

• The "well-funded" guarantee protected against a specific failure mode (unbounded trader payouts) but did not protect against oracle manipulation/staleness or chain-level infrastructure bugs — the actual vector used in the exploit.
• Levana's security depended on external, composed systems (Osmosis fee market, Pyth price feeds) that were outside the protocol's direct control; a bug in either was sufficient to bypass the core solvency design.
• The slow, 13-day duration of the exploit before detection suggests monitoring/alerting gaps, allowing what might have been a contained incident to compound into a larger loss.
• Broad name confusion with unrelated "Levana Finance" (a UK mortgage broker) complicates public discovery and due diligence, though this reflects branding coincidence rather than a protocol design flaw.

Lessons

• A mechanism that mathematically eliminates one risk (bad debt from unbounded payouts) can still be fully undermined by an adjacent, unaddressed risk (oracle staleness, host-chain fee market bugs) — "solved" risks must be evaluated as part of the full dependency stack, not in isolation.
• Protocols built on newer or less battle-tested app-chains/DEXs inherit those chains' immaturity; congestion and fee-market bugs on Osmosis directly enabled the exploit, showing that perp protocols are only as robust as the infrastructure they settle against.
• Detection latency matters as much as prevention: a slow-motion drain over two weeks implies real-time monitoring and circuit breakers are as important as the core solvency mechanism itself.
• Migrating an entire protocol to a new ecosystem after a foundational chain's collapse (Terra -> Cosmos/Osmosis) is achievable but does not reset accumulated technical/operational risk — new integration surfaces (oracle, fee market) introduce new attack vectors.

Redesign (EDITORIAL)

EDITORIAL — hypothesis, not fact. A more resilient version of Levana's "well-funded perps" model might combine the existing pre-committed-payout mechanism with (1) a multi-oracle price validation layer that rejects trades or halts markets when any single feed shows anomalous staleness or deviation beyond a tight threshold, rather than trusting a single Pyth feed per market; (2) protocol-level circuit breakers keyed to abnormal cumulative PnL flow to a single address or cluster of addresses within a rolling window, auto-pausing suspicious markets pending manual review; and (3) treating host-chain infrastructure (fee markets, block production) as an explicit, monitored risk surface with automated alerts for anomalies like the Osmosis gas-price bug, rather than assuming chain-level correctness. This would extend the "well-funded" philosophy — bound and pre-commit every risk explicitly — from position-level payouts to the full oracle and infrastructure dependency chain.