The Terra Ecosystem’s DeFi app Mirror Protocol is under attack again. At press time, the mBTC, mDOT, mETH, and mGLXY synthetic asset pools on the protocol have been depleted, with a preliminary estimate of a loss of around $2 million.
According to community members , the hackers may have exploited a bug in a misconfigured price oracle to carry out the attack.
The well-known cryptocurrency KOL ChainLinkGod subsequently confirmed this argument: “The oracle is currently reporting the price of the new LUNA token (about $9.80), not the original LUNC token (about $0.0001).” He criticized, “It was a pretty serious mistake.”
According to The Block, if the vulnerability remains unfixed by 4:00 a.m. ET (4:00 p.m. Taiwan time), all of Mirror Protocol’s tokenized asset pools will be at risk.
According to reports, Mirror Protocol is a synthetic asset protocol created by Terraform Labs, running on the original Terra blockchain (now called Terra Classic), and its role is similar to a comprehensive exchange, allowing users to over-collateralize , to mint UST into various assets. For example, if users want to invest in U.S. stocks, they can mortgage UST to mint synthetic assets such as Apple’s mAAPL or Tesla’s mTSLA.
Todd Garrison, founder of the validator node BlockPane, said that the problem is that most validators running nodes on the Terra Classic chain are running old versions of the price oracle, and these nodes still give Mirror Protocol the LUNC price of 5 UST. Todd Garrison said that if the LUNC price oracle is not repaired as soon as possible, all liquidity pools will be exhausted in a short period of time, Mirror Protocol will generate irreparable bad debts, and the system will collapse on its own.
According to estimates by Terra community member FatMan, the vulnerability has caused the Mirror Protocol to lose more than $2 million. Although the liquidity of the mBTC, mDOT, mETH and mGLXY synthetic asset pools has been exhausted, there is still time to rescue mAAPL, mAMZN and other mAsset asset pools.
Mirror Protocol is being exploited again as we speak, and the devs are completely MIA. So far, the attacker has drained over $2m and counting - the attack will get worse when markets open tomorrow unless the dev team steps in and fixes the price oracle. @mirror_protocol (1/4)
— FatMan (@FatManTerra) May 30, 2022
As of press time, the bug appears to have been fixed and oracle quotes have returned to normal.
Just last week, FatMan revealed that the Mirror Protocol had suffered an attack late last year that took seven months to discover and cost $90 million.
