Over $2 Million Drained From Terra’s Mirror Protocol in New Exploit

Another DeFi exploit has drained over $2 million in crypto from a protocol on Terra Classic, shortly after its historic collapse. If the developers wouldn’t have fixed it quickly, the hackers could have stolen far more money.

The governance participant “Mirroruser” of the Terra Research Forum was the first to discover the exploit on Monday. He noted that the attack drained all the pools bridging to Bitcoin, Ethereum, and Polkadot. “All other pools will get drained as soon as new oracle prices show up.”

• According to the analyst FatMan on Twitter, an oracle bug was causing Mirror to read LUNC’s value as $5, rather than fractions of a cent.
• The token – formerly LUNA – saw its value plummet due to hyperinflation this month. Whereas it once traded above $100, one token is now worth less than a satoshi.
• According to a Chainlink Community member, the oracle mispricing was due to validators running outdated oracle software. In fact, they were reporting an outdated price of the new LUNA instead of the former, devalued LUNC.
• Due to the mispricing, users could use LUNA as collateral to borrow more money from the protocol than possible. “ For $1k in LUNC, an attacker can now load up on $1.3m in collateral but can pull out real assets by borrowing,” explained FatMan that afternoon.
• He also warned that once the market “kicked in” within 12 hours of the tweet, all other pools would be vulnerable.

Luna

Terra

$0.0000710400
price

5.37439%
price change

BUY NOW

Thankfully, developers managed to patch the bug just in time, rescuing the remaining pools of funds. Nevertheless, over $2 million in funds had been stolen due to what FatMan called “negligence of the highest order.”