Luna Classic (LUNC) pricing error leads to Mirror Protocol exploit
An error on the pricing oracle software for Terra Classic validators opened the door for an exploiter to drain four synthetic asset pools from the Mirror Protocol.
A mismatch in the reported price of underlying assets synthetic assets DeFi platform Mirror Protocol has caused an ongoing exploit that has the potential to drain all of its funds.
The exploit was observed on May 29 by governance participant "Mirroruser" on the protocol's forum as of the time of writing. the mBTC, mDOT, mETH, and mGLXY synthetic asset pools on the protocol have lost almost all of their assets valued at over $2 million.
A mirror allows trading synthetic assets, such as stocks and cryptocurrency on the Terra Classic Layer 1 blockchains BNB Chain (BNB), and Ethereum (ETH).
A pricing error for LUNA Classic (LUNC) made the exploit possible. The remaining validators on Terra Classic reported that the price of LUNC ($0.000122) was the same as the newly launched LUNA ($9.32) even though their real market prices vary wildly according to CoinGeco.
Chainlink community ambassador "ChainLinkGod" explained on May 31 that the "Terra Classic Validators were running an outdated" version of the oracle software."
.@mirror_protocol has just been exploited again due to Terra Classic validators reporting the price of the new Terra 2.0 $LUNA coin (~$9.80) instead of the original Terra Classic $LUNC coin (~$0.0001)— ChainLinkGod.eth (@ChainLinkGod) May 30, 2022
This is a massive operations failurehttps://t.co/hO0M0UFBYq https://t.co/ygbr3ij4iS pic.twitter.com/PO0huxX8oQ
Venu's Protocol and Blizz Finance each suffered from a similar exploit in May when price oracle Chainlink's reported LUNA price remained at $0.10 while the market price ran far below that Blizz Finance were entirely drained while Venus lost $11.2 million.
Terra community whistleblower on Twitter, pseudonymous 'FatMan' warned that the Mirror exploit will affect the other 'm' asset pools by about 8:00 am UTC on May 31. the account also claims that most of the pools can be saved if the developers intervene to fix the bug
By 12:55 am UTC, it appeared that the pricing error had been fixed for LUNC, as the price is verified by the oracle had returned to its real market value.
This is the second time Mirror has suffered from a major vulnerability. The previous bug in Mirror's code was exploited "hundreds of times" since 2021 according to FatMan in a May 27 tweet. The first exploit allowed a user to unlock other users' collateral on the protocol and pull it out themselves. in all, the first exploiter got away with "well over $30 million" and was not noticed until May 2022, he added.
On May 28, the Terra ecosystem was relaunched when Terra 2.0 went online as per founder Do Kwon's plans. Terra 2.0 is a fork of the now harmed Terra Classic blockchain. LUNA tokens are being airdropped to investors who held the previous version of LUNA and the TerraUSD (UST) Stablecoin during the catastrophic collapse of the Terra ecosystem earlier this month.
Mirror Protocol (MIR) tokens are currently down 2% in the past 24 hours and are trading at $0.31 according to CoinGecko.