Likwid exploit analysis

Likwid's leveraged margin product on BNB Chain paid 74.31 BNB into a frozen AMM on 2026-09-18 after a missing pairDelta update let an attacker claim liquidity at a stale ratio (attack transaction, block 122525331). DeFiHackLabs reconstructs the freeze on a BSC fork and reproduces the loss to within three wei.

Likwid's margin borrow pathway takes a leverage argument that selects how the borrowed amount is converted into the AMM quote. For leverage == 0, the code path is supposed to update pairDelta to reflect the borrowed amount before the AMM is queried, so the helper's quote reflects the new reserve. The conversion step skipped the pairDelta update, so the AMM continued quoting as if no borrow had happened. The attacker held 218.58M TOKEN pre-attack and used repeated addMargin calls to drive pairDelta against the unchanged AMM state, withdrawing the AMM's BNB reserve into the attacker's helper at the frozen quote.

DeFiHackLabs records the loss as 74.31 BNB, reproduced within three wei of the attacker's net BNB inflow.

The clean fix is to update pairDelta on every leverage branch, including the leverage == 0 one, before reading the AMM.