{"id":48065,"date":"2022-05-31T14:06:28","date_gmt":"2022-05-31T12:06:28","guid":{"rendered":"https:\/\/crypto-economy.com\/?p=48065"},"modified":"2022-05-31T14:06:28","modified_gmt":"2022-05-31T12:06:28","slug":"terras-mirror-protocol-suffers-another-exploit","status":"publish","type":"post","link":"https:\/\/crypto-economy.com\/terras-mirror-protocol-suffers-another-exploit\/","title":{"rendered":"Terra&#8217;s Mirror Protocol Suffers Another Exploit"},"content":{"rendered":"<p style=\"text-align: justify\">DeFi application, Mirror Protocol, has suffered another attack draining over <strong>$2 million.<\/strong> Cyber criminals depleted <strong>four synthetic asset pools<\/strong> from the protocol, with the potential to drain funds from all other pools in the coming days.<!--more--><\/p>\n<p style=\"text-align: justify\">Troubles continue to escalate for Terra. <a href=\"https:\/\/crypto-economy.com\/is-mirror-protocol-a-farce\/\" target=\"_blank\" rel=\"noopener\">Mirror Protocol<\/a>, built on Terra, had been undergoing a second attack due to a bug in the <strong>LUNA CLASSIC (LUNC) pricing oracle.<\/strong> The capital pools of Bitcoin (BTC), Ethereum (ETH) and Polkadot (DOT) had been drained which resulted in a loss of over $ 2 million worth of assets. It is believed that if the bug is not fixed by tomorrow before the market opens, all of its <strong>token asset pools will be at risk.\u00a0<\/strong><\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Mirror Protocol is being exploited again as we speak, and the devs are completely MIA. So far, the attacker has drained over $2m and counting &#8211; the attack will get worse when markets open tomorrow unless the dev team steps in and fixes the price oracle. <a href=\"https:\/\/twitter.com\/mirror_protocol?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener\">@mirror_protocol<\/a> (1\/4)<\/p>\n<p>&mdash; FatMan (@FatManTerra) <a href=\"https:\/\/twitter.com\/FatManTerra\/status\/1531365988809293825?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener\">May 30, 2022<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<h2 style=\"text-align: justify\">How Did The Attack Happen?<\/h2>\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">So far, the mBTC, mETH, mDOT and mGLXY pools have been drained. In around 12 hours, the market feed will kick in, and the attacker will be able to drain all of the mAsset pools (such as mSPY and mAAPL, mAMZN, etc.) &#8211; most of the pools can still be saved. (3\/4)<\/p>\n<p>&mdash; FatMan (@FatManTerra) <a href=\"https:\/\/twitter.com\/FatManTerra\/status\/1531365991955013632?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener\">May 30, 2022<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p style=\"text-align: justify\">The incident was first reported by pseudonymous governance participant <strong>\u2018Mirroruser\u2019,<\/strong> on the Terra Research Forum. The individual even <a href=\"https:\/\/forum.mirror.finance\/t\/another-exploit\/3511\" target=\"_blank\" rel=\"noopener\">shared<\/a> the addresses and the short trades of the perpetrator. Mirroruser wrote,<\/p>\n<p style=\"text-align: center\"><em>&#8220;Happening now. Probably invalid uluna oracle price. mBTC, mETH, mDOT pools drained. All other polos will get drained as soon as new oracle prices show up.&#8221;<\/em><\/p>\n<p style=\"text-align: justify\">News of the attack was then quickly circulated by Twitter user, FatMan, who explained that the hack was possible due to an<strong> error in the configuration of price oracles.<\/strong> The Mirror\u2019s lock contract allegedly <strong>failed to check<\/strong> when someone used the same ID more than once to withdraw funds.<\/p>\n<p style=\"text-align: justify\">FatMan, warned that the Mirror Protocol is on the verge of collapse as developers have done <strong>&#8220;nothing&#8221;<\/strong> to fix the issue. They also asked users to withdraw all their funds from the protocol. He tweeted,<\/p>\n<p style=\"text-align: center\"><em>&#8220;It looks like nothing will be done and the project will collapse tomorrow for sure (there are other vectors too), so get all your money out of Mirror right now.&#8221;<\/em><\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\"><a href=\"https:\/\/twitter.com\/stablekwon?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener\">@stablekwon<\/a> <a href=\"https:\/\/twitter.com\/mirror_protocol?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener\">@mirror_protocol<\/a> Please look into fixing the LUNC price oracle, because in a short while, all liquidity pools will be drained, Mirror will accrue irremediable bad debt, and the system will collapse in on itself. This is not the time to be negligent. (4\/4)<\/p>\n<p>&mdash; FatMan (@FatManTerra) <a href=\"https:\/\/twitter.com\/FatManTerra\/status\/1531365993330745345?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener\">May 30, 2022<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<h2 style=\"text-align: justify\">Outdated Versions OF Price Oracles Caused The Heist<\/h2>\n<p style=\"text-align: justify\"><img fetchpriority=\"high\" decoding=\"async\" class=\"aligncenter wp-image-47962 size-full\" src=\"https:\/\/crypto-economy.com\/wp-content\/uploads\/2022\/12\/5_11-15.jpg\" alt=\"Terra Mirror Protocol Suffers Another Exploit\" width=\"622\" height=\"138\" \/><\/p>\n<p style=\"text-align: justify\"><strong>Todd Garrison<\/strong>, founder of validator node BlockPane, explained that most validators running nodes on the Terra Classic chain are <strong>running outdated versions of price oracles<\/strong>, and those nodes still give Mirror Protocol the LUNC price of 5UST. There is an <strong>urgent need to fix the LUNC price oracle<\/strong>, because in a short time, all liquidity pools will be exhausted.<\/p>\n<p style=\"text-align: justify\">Meanwhile,\u00a0Chainlink (LINK) community ambassador <strong>\u2018ChainLinkGod\u2019<\/strong> confirmed on a Twitter post that the issue has occurred due to Terra Classic validators <strong>&#8220;running an outdated version of the oracle software.\u201d<\/strong><\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Crisis averted &#8211; in the nick of time, Mirror disabled the usage of mBTC, mETH, mGLXY and mDOT as collateral. The attacker can no longer use his ill-gotten endowment to drain the rest of the pools. Great job <a href=\"https:\/\/twitter.com\/mirror_protocol?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener\">@mirror_protocol<\/a> &#8211; thank you! <a href=\"https:\/\/t.co\/o64SVIRBmZ\" target=\"_blank\">https:\/\/t.co\/o64SVIRBmZ<\/a><\/p>\n<p>&mdash; FatMan (@FatManTerra) <a href=\"https:\/\/twitter.com\/FatManTerra\/status\/1531549670740267009?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener\">May 31, 2022<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p style=\"text-align: justify\">However, it is reported that the Mirror Protocol, has managed to avoid the crisis by disabling the usage of certain mirrored assets as collateral. After much delay, it\u00a0appeared\u00a0that the pricing error fixed for LUNC, as the price verified by the oracle has returned to its real market value.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>DeFi application, Mirror Protocol, has suffered another attack draining over $2 million. Cyber criminals depleted four synthetic asset pools from the protocol, with the potential to drain funds from all other pools in the coming days.<\/p>\n","protected":false},"author":21,"featured_media":48082,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[70,74,122],"tags":[5258,4752,5547,5483,5530],"_links":{"self":[{"href":"https:\/\/crypto-economy.com\/wp-json\/wp\/v2\/posts\/48065"}],"collection":[{"href":"https:\/\/crypto-economy.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crypto-economy.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crypto-economy.com\/wp-json\/wp\/v2\/users\/21"}],"replies":[{"embeddable":true,"href":"https:\/\/crypto-economy.com\/wp-json\/wp\/v2\/comments?post=48065"}],"version-history":[{"count":0,"href":"https:\/\/crypto-economy.com\/wp-json\/wp\/v2\/posts\/48065\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/crypto-economy.com\/wp-json\/wp\/v2\/media\/48082"}],"wp:attachment":[{"href":"https:\/\/crypto-economy.com\/wp-json\/wp\/v2\/media?parent=48065"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crypto-economy.com\/wp-json\/wp\/v2\/categories?post=48065"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crypto-economy.com\/wp-json\/wp\/v2\/tags?post=48065"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}