Luna Classic pricing error leads to Mirror Protocol exploit

Published at: May 31, 2022

A mismatch in the reported price of underlying assets on synthetic assets decentralized finance (DeFi) platform Mirror Protocol has caused an ongoing exploit that has the potential to drain all of its funds.

The exploit was observed on Sunday by governance participant Mirroruser on the protocol’s forum. As of the time of writing, the Mirror BTC (mBTC), Mirror Polkadot (mDOT), Mirror Ether (mETH) and Mirror Galaxy (mGLXY) synthetic asset pools on the protocol have lost almost all of their assets valued at over $2 million.

Mirror allows trading of synthetic assets such as stocks and cryptocurrency on the Terra and Terra Classic layer-1 blockchains, BNB Chain and Ethereum.

A pricing error for Luna Classic (LUNC) made the exploit possible. The remaining validators on Terra Classic reported that the price of LUNC at $0.000122 was the same as the newly launched Terra (LUNA) ($9.32), even though their real market prices vary wildly according to CoinGecko.

Chainlink community ambassador ChainLinkGod explained on Tuesday that the “Terra Classic validators were running an outdated version of the oracle software.”

.@mirror_protocol has just been exploited again due to Terra Classic validators reporting the price of the new Terra 2.0 $LUNA coin (~$9.80) instead of the original Terra Classic $LUNC coin (~$0.0001)This is a massive operations failurehttps://t.co/hO0M0UFBYq https://t.co/ygbr3ij4iS pic.twitter.com/PO0huxX8oQ

— ChainLinkGod.eth (@ChainLinkGod) May 30, 2022

Venus Protocol and Blizz Finance each suffered from a similar exploit in May when price oracle Chainlink’s reported LUNA price remained at $0.10, while the market price ran far below that. Blizz Finance was entirely drained while Venus lost $11.2 million.

Terra community whistleblower on Twitter, pseudonymous FatMan, warned that the Mirror exploit will affect the other “m” asset pools by about 8:00 am UTC on Tuesday. However, the account also claims that most of the pools can be saved if the developers intervene to fix the bug.

By 12:55 am UTC, it appeared that the pricing error had been fixed for LUNC, as the price being verified by the oracle has returned to its real market value.

This is the second time Mirror has suffered from a major vulnerability. The previous bug in Mirror’s code was exploited “hundreds of times” since 2021, according to FatMan in a Friday tweet. The first exploit allowed a user to unlock other users’ collateral on the protocol and pull it out themselves. In all, the first exploiter got away with “well over $30 million” and was not noticed until May 2022, he added.

Related: Korean watchdog begins risk assessment of crypto as Terra 2.0 passes vote

On Saturday, the Terra ecosystem was relaunched when Terra 2.0 went online, as per founder Do Kwon’s plans. Terra 2.0 is a fork of the now-named Terra Classic blockchain. LUNA tokens are being airdropped to investors who held the previous version of LUNA and the TerraUSD (UST) stablecoin during the catastrophic collapse of the Terra ecosystem earlier this month.

Mirror Protocol (MIR) tokens are currently down 2% in the past 24 hours and are trading at $0.31, according to CoinGecko.

Tags
Altcoin
Defi
Smart Contracts
Cybersecurity
Terra
Related Posts
Number of devs increased during crypto winter: Electric Capital report
The notion that bear markets are good for builders appears to be true with the total number of monthly active Web3 developers increasing 5.4% to more than 23,300 over the last 12 months despite a near 70% drop in crypto prices. According to a Jan. 16 report from Electric Capital, “full-time” developers — categorized as those who contribute to 76% of Github commits — also increased 15.2% to over 7000, while “one-time” builders fell 6.2% to over 3,500 during the same time period between December 2021 and December 2022 Despite the crypto market capitalization beginning its long plunge from from …
Adoption / Jan. 18, 2023
3 reasons why Lido DAO Token could be on the verge of breaking its downtrend
Ethereum (ETH) and decentralized finance (DeFi) are undergoing a seismic shift as the transition to Eth2 and a proof-of-stake consensus mechanism is helping to increase the value proposition for the network which has historically has been plagued with scaling issues and high transaction costs. Alongside this transition has been the introduction of liquid staking, which is helping to add utility to DeFi and giving investors the option to do more with their assets than just lock them up indefinitely. Liquid staking could also help investors build more capital efficient portfolios. One protocol that has benefited from the shift toward liquid …
Adoption / Feb. 26, 2022
Impermanent loss challenges the claim that DeFi is the ‘future of France’
Impermanent loss is one of the most recognized risks that investors have to contend with when providing liquidity to an automated market maker (AMM) in the decentralized finance (DeFi) sector. Although it is not an actual loss incurred from the liquidity provider’s (LP) position — rather an opportunity cost that occurs when compared with simply buying and holding the same assets — the possibility of getting less value back at withdrawal is enough to keep many investors away from DeFi. Impermanent loss is driven by the volatility between the two assets in the equal-ratio pool — the more one asset …
Blockchain / March 5, 2022
Altcoin Roundup: Three layer-1 protocols see inflows amid choppy, volatile market conditions
Layer-1 (L1) protocols are the foundation of the decentralized application ecosystem, with the Ethereum network dominating the landscape in terms of the number of protocols launched on-chain and total value locked (TVL), followed by BNB Chain and Fantom. As the sideways market of 2022 drags on and serious projects use the time away from the frenzy of bull markets to work on development, several L1 protocols have been outperforming the field and making gains despite weakness in the wider crypto market. Here’s a look at three L1 protocols that are seeing growth in their decentralized finance (DeFi) communities and an …
Markets / March 18, 2022
Terra 2.0: A crypto project built on the ruins of $40 billion in investors' money
Terra remained the focus of the majority of headlines throughout May for its spiral collapse leading to a loss of over $40 billion in investors’ money. Despite some early resistance from the community and heavy backlash from the likes of Binance CEO Changpeng “CZ” Zhao, Terra co-founder Do Kwon managed to relaunch the collapsed network with a new chain called Terra 2.0 (Phoenix-1). The amended proposal for the relaunch of the network by increasing the genesis liquidity, which introduces a new liquidity profile for pre-attack Luna Classic (LUNC) holders and decreases the distribution to post-attack TerraUSD Classic (USTC) holders, was …
Decentralization / June 3, 2022