Terra's Mirror Protocol Suffers Another $2M Exploit

Mirror Protocol, a DeFi application built on the Terra LUNA/USD blockchain, has seen $2 million in user funds drained over the weekend thanks to a pricing error.

What Happened: According to a May 29 alert from Mirroruser on the protocol’s community forum, the Mirror Protocol suffered an exploit on its mBTC, mDOT, mETH, and mGLXY synthetic asset pools.

The Mirror Protocol enables users to trade synthetic versions of stocks like Tesla Inc  TSLA and Apple Inc AAPL and cryptocurrencies on the Ethereum ETH/USD, BNB Chain BNB/USD  Terra Classic and Terra blockchains.

Mirror Protocol is being exploited again as we speak, and the devs are completely MIA. So far, the attacker has drained over $2m and counting - the attack will get worse when markets open tomorrow unless the dev team steps in and fixes the price oracle. @mirror_protocol (1/4)

— FatMan (@FatManTerra) May 30, 2022

“A bug in the pricing oracle is telling the system that LUNC is worth around 5 UST when it's actually under a microcent,” Terra researcher FatMan explained on Twitter.

“For $1k in LUNC, an attacker can now load up on $1.3m in collateral but can pull out real assets by borrowing.”

It seems the root cause was that Terra Classic validators were running an outdated version of the oracle software https://t.co/G25tUPcU0r

— ChainLinkGod.eth (@ChainLinkGod) May 30, 2022

On Sunday, The Block reported that a $90 million exploit from October 2021 was discovered on Mirror. The exploit went completely unnoticed for a period of seven months, despite an abundance of on-chain data confirming the event.

Price Action: According to data from Benzinga Pro, LUNA was trading at $9.04 at press time, up 40% over the last 24 hours.