DeFi App Mirror Protocol Suffers Fresh Exploit Due to LUNA Classic Pricing Error

Mirror Protocol, a decentralised finance (DeFi) app on the Terra blockchain, has suffered yet another exploit due to an error in the configuration of price oracles, just days after discovering that it had been exploited for almost $90 million (roughly Rs. 700 crore) seven months ago. The attacker has leveraged the fact that price oracles are mismatching the old Terra Classic (LUNC) token with the new LUNA token. This was confirmed by a Chainlink community member who said oracles are currently "reporting the price of the new Terra 2.0 $LUNA coin instead of the original Terra Classic $LUNC coin."

Quickly circulated on Twitter by user and Terra Research Forum member FatMan (@FatManTerra), who discovered the previous Mirror exploit four days ago.

According to FatMan, the hack was possible due to an error in the configuration of price oracles. FatMan estimates the exploit has already cost Mirror Protocol around $2 million (roughly Rs. 15.5 crore) when first reported at 1:30 am IST. FatMan has since tweeted that Mirror Protocol has reacted and disabled mBTC, mETH, mGLXY, and mDOT as collateral and thus prevented the attacker from draining other liquidity pools completely. That said, we don't yet have an official figure as to how much the attacker has been able to drain from Mirror Protocol's pool combined.

For the uninitiated, Mirror Protocol is a decentralised application that allows for the creation of digital synthetics that track the price of real-world assets, such as stocks. Mirror's core contracts were deployed on Terra Classic, but its assets are available on networks like Ethereum.

This is the second time Mirror Protocol has suffered from a major vulnerability. The previous bug in Mirror's code was exploited "hundreds of times" since 2021 according to a tweet from FatMan.

Cryptocurrency is an unregulated digital currency, not a legal tender and subject to market risks. The information provided in the article is not intended to be and does not constitute financial advice, trading advice or any other advice or recommendation of any sort offered or endorsed by NDTV. NDTV shall not be responsible for any loss arising from any investment based on any perceived recommendation, forecast or any other information contained in the article.