A critical vulnerability has been uncovered in a fork of the Gains Network's leveraged trading protocol, potentially allowing traders to exploit the system for a 900% profit on every transaction. The issue was discovered by the blockchain security company Zellic, which noted that the flaw could have let traders manipulate the system by setting excessively high stop-loss prices, effectively guaranteeing a massive profit irrespective of actual market movements.

The flaw was identified in a derivative version of the original Gains Network protocol. While the original Gains protocol had a similar issue in its earlier versions, it has since been patched. However, the forked version appears to have retained the vulnerability. Zellic reported this finding on April 19, emphasizing the potential risk to investors and the integrity of the trading platform.

According to Zellic's investigation, the exploit revolves around how the protocol calculates profits and losses. Specifically, the bug was in how the 'currentPrice' variable, which should reflect real-time market prices, was being misused to set an artificial price point. Traders could set a high stop-loss that the system erroneously used as the current price, thus registering a false profit.

For example, if a trader set the opening price of Bitcoin at $62,000 and a stop-loss at $64,000, and the market price dropped to the opening price, the system would automatically execute the stop-loss. The system flaw would then calculate the profits based on the difference between the stop-loss and the market price at the time of the trade execution, regardless of the actual market movement.

Moreover, Zellic found that this bug could be exploited by placing a limit buy order with an extraordinarily high open price, which would bypass normal trading checks and validations. Once such an order was placed, the trader could then execute their own stop-loss at an artificially set price, resulting in an inflated profit margin.

The security firm has alerted developers of various Gains forks, including Gambit Trade, Holdstation Exchange, and Krav Trade, about the issue. These teams have since confirmed that their protocols have been secured against this particular vulnerability. Nonetheless, Zellic warns that other forks of the Gains Network might still be susceptible, posing a risk to the broader ecosystem.

Zellic's findings highlight the ongoing challenges in ensuring the security and reliability of decentralized finance (DeFi) platforms, especially as they scale and become more complex. The discovery of such vulnerabilities underscores the importance of rigorous security practices and continuous auditing of smart contracts and blockchain protocols to protect users' investments and maintain trust in these emerging financial systems.