single post img

An exploiter was able to drain four synthetic asset pools from the Mirror Protocol due to an error in the Terra Classic pricing oracle software. 


Also read: After the Luna crash, is it still ok to invest in cryptos?


An ongoing exploit on DeFi’s synthetic assets platform Mirror Protocol is being used to drain all the funds due to a mismatch in the reported price of underlying assets. 

‘Mirroruser’, a governance participant who participates in the protocol’s forum, observed the exploit on May 29. As of the time of writing, the synthetic asset pools for mBTC, mDOT, mETH, and mGLXY have lost their assets worth more than $2 million.  

The Mirror platform enables traders to trade synthetic assets, including stocks and cryptocurrencies, on the Terra and Terra Classic layer-1 blockchains and the BNB Chain (BNB) and Ethereum (ETH).


Also read: Terra wasn’t an easy runner, and it was poorly designed.


The exploit was made possible by an error in Luna Classic’s pricing. While the real market prices of the two tokens differ wildly, the remaining Terra Classic validators noted that the LUNC ($0.000122) price was the same as the LUNA ($9.32), despite their price differences according to CoinGecko.

‘ChainLinkGod,’ a Chainlink community ambassador, explained on May 31 that the “Terra Classic validators were running an outdated version of Oracle.” 



In May, Blizz Finance and Venus Protocol both fell victim to the same exploit, with Price Oracle Chainlink’s reported price for the LUNA coin stayed at $0.10, while the market price dropped significantly. VENUS incurred a $11.2 million loss after Blizz Finance was drained.  

‘FatMan’, commonly known by the Twitter handle TerraCommunity, predicted the Mirror flaw would affect the other ‘m’ asset pools around 8:00am UTC on May 31. In addition, if the developers intervene to fix the bug, most pools could be saved.  

The LUNC pricing error appears to have been fixed by 12:55am UTC, as the oracle price indicating its market value has returned to the real value.  


Also read: Terraform Labs Korea was dissolved by Do Kwon just days before the LUNA crash, according to court documents


Mirror has been vulnerable to a major vulnerability a second time. FatMan tweeted on May 27 that “hundreds” of uses had exploited a previous bug in Mirror’s code since 2021. A user who exploited the first security vulnerability on the protocol was able to pull out collateral belonging to other users. The first exploiter took a total of $30,000, who was not caught until May 2022.

Following the plans of founder Do Kwon, Terra 2.0 was launched on May 28. The Terra Classic blockchain has been forked into Terra 2.0. The TerraUSD (UST) stablecoin has been replaced with LUNA tokens by LUNA airdrops to investors who held Terra Classic and the Terra Classic blockchain during the collapse of Terra yesterday.  

CoinGecko reports that for the past 24 hours, Mirror Protocol (MIR) tokens have lost 2% and are currently trading at $0.31.


Also read: Elon Musk says SpaceX will start accepting DOGE payments for merch