Rujira's $200,000 CCL Exploit: What LPs Need to Check
Rujira estimates that an attacker caused about $200,000 in losses by exploiting the calculations behind its BTC/USDC liquidity strategy. A carefully chosen trading range doesn’t protect you from a bug in the strategy executing it.
In its November 11 update, Rujira attributed the previous evening’s attack to its Custom Concentrated Liquidity (CCL) skew calculations. It put roughly $175,000 of the loss in Liquidy Finance’s positions and $25,000 in other user funds.
The team said the CosmWasm application layer was halted. Its recovery plan included reimbursing all losses and removing the skew parameter from the contract, with an estimated 1–2 days before asking nodes to resume the app layer.
That’s the team’s account and timetable. Completed payments and a restart weren’t independently verified for this post. A promised reimbursement shouldn’t be counted as money back in your wallet.
What the skew setting does
Rujira’s strategy documentation describes CCL as an algorithmic way to provide liquidity within a chosen range. Skew controls how liquidity is distributed within that range: more near the middle, or more toward its edges.
For BTC/USDC, concentrating near the edges is meant to buy more BTC near the bottom and sell more near the top. That gives the provider another way to express a market view, but the contract has to calculate and execute those trades correctly.
The docs still describe skew at the time of this check. Given the announced removal, don’t assume an older setup guide describes the version that will reopen.
Our Uniswap range explainer covers the ordinary risk of ending up entirely in one asset as price crosses a boundary. Rujira’s reported loss concerns an implementation flaw. Widening a range doesn’t establish that the code handling it is safe.
Before putting money back in
An attractive yield is a poor reason to rush past an unresolved recovery. For an affected position, the useful evidence is specific:
- A reimbursement record that matches the position and amount owed, with funds actually received.
- A published description of the contract change and what review or testing it received.
- A current official notice explaining which services have resumed and how existing positions are handled.
Removing one parameter may address this reported attack path. It doesn’t establish that every remaining path has been checked. And a team covering this loss wouldn’t tell you how much it could cover next time, a question that also matters in the recent Loopscale incident.
The range is only one part of the risk you’re taking. The strategy gets to trade your principal.
