Mirror Protocol was exploited for over $2 million with many pools drained. When pre-market trading begins tomorrow morning, the attacker might be able drain the remaining pools.
Mirror Protocol, a DeFi App on Terra blockchain, has been the victim of another exploit. More than $2 million has already been stolen. If the bug is not fixed by 4:00 AM ET tomorrow all its tokenized assets pools will be at risk.
Mirror protocol allows users take long and short positions in tech stocks using synthetic assets. It runs on Terra Classic, the original Terra blockchain. This new blockchain was created after TerraUSD (UST), its main stablecoin, collapsed. Luna Classic (LUNC) is now the Luna Classic (LUNC). The old blockchain is still in use, despite being put on hold.
Mirror protocol has its own versions for other cryptocurrencies such as mBitcoin, which is tied to the price of bitcoin. These pools are the ones that have been drain so far. Mirror Protocol’s website states that the pools for bitcoin and ether have been drained. The pool for Galaxy Digital stock tokens has also been drain.
FatMan, a Terra community member — who was opposed to the launch of the Terra blockchain — estimates that more than $2,000,000 has been taken thus far. The Block was informed by him that he had looked at several transactions to arrive at this estimate. However, he has requested researchers to add up the total amount.
All remaining pools are tied to stocks, and they won’t be available for trading until premarket trading opens at 4:00 AM ET. The exploit can be used to access the remaining pools, unless the bug has been fixed.
What is the cause of this problem?
It appears that the issue is related to the protocol’s Oracle. An oracle refers to the method a protocol collects data from the real world. The oracles retrieve data about the price of stocks and certain cryptocurrency.
Todd Garrison, the founder of Block Pane, a network that runs validator nodes across various blockchains, says the problem is that most validators on Terra Classic are using an old price oracle. These nodes tell the Mirror Protocol that LUNC has a value of 5 TerraUSD (UST), instead of just a fraction.
“Please fix the LUNC price Oracle, because in a brief while, all liquidity pools are going to be drained. Mirror will then accrue irremediable bad credit and the system will crash in itself.” He linked relevant Twitter accounts to his tweet, “This is not the right time to be negligent.”
Over the past few days, the attack has continued. However, it has not affected most tokenized stocks. The stock market was closed for Memorial Day in the US and the weekend. The exploit was discovered by “Mirroruser”, a pseudonymous user who reported it to the Mirror forum. They also provided multiple addresses that were related to the exploit.
FatMan also discovered a bug in Mirror Protocol last week that was confirmed by BlockSec security analysts. FatMan discovered that the protocol was the victim of a $90million exploit towards the end last year. This exploit went unnoticed by security analysts BlockSec for seven months.
