Terra community thwarts attack on Mirror Protocol liquidity pools – Bits Media

Community members of the failed Terra project have identified an exploit, threatening liquidity pools and forced developers to disable the use of mBTC, mETH, mGLXY and mDOT as collateral.

Two days after the launch of the updated Terra 2.0 username Mirroruser informed the community about the exploit he discovered, potentially threatening to restart the entire project. According to his observations, в отношении протокола Terra’s Mirror проводится целенаправленная атака и злоумышленник уже похитил активы на сумму около $2 million.

«Это происходит прямо сейчас. Probably, из-за неактуальной цены оракула uluna, пулы mBTC, mETH and mDOT merged. All other pools will be depleted, as soon as new oracle prices appear", – written by Mirroruser.

Mirroruser attached a list of addresses and completed transactions to his message.

30 May, complementing Mirroruser's post, a regular member of the Terra community under the nickname FatMan said in a tweet, that the Mirror Protocol problem was identified seven months ago, in October 2021 of the year, but neither Mirror Protocol, Neither Terraform Labs responded to it. FatMan explained to the project participants the potential danger of the events taking place. In his understanding, the problem is, that there is still a bug in Terra's current price oracle, которая сообщает системе, что «LUNC стоит около 5 UST, хотя на самом деле он дешевле микроцента». Hence, «за $1 000 в LUNC злоумышленник может получить залог на $1.3 млн и украсть реальные активы, eg, взяв кредит».

FatMan warned, that as soon as full-fledged market trading of Terra assets opens, then the situation will worsen significantly, and an attacker or group of attackers will try to drain all assets in the pools.

“Currently mBTC pools, mETH, mDOT and mGLXY are depleted. In about 12 o'clock the market feed will turn on, and the attacker will be able to empty all mAsset pools (such as mSPY and mAAPL, mAMZN, etc. d.)», – FatMan wrote on Twitter.

Mirroruser and FatMan's concerns were shared by another community member, security specialist under the nickname Todd G. He wrote, that "most #TerraClassic #LUNC validators use an outdated version of the price oracle, publishes out-of-date prices and needs to be updated as soon as possible".

The Mirror Protocol and Terraform Labs teams have not officially responded to the warnings.. but, as FatMan learned, the crisis was averted at the very last moment: 31 May Mirror disabled the use of mBTC, mETH, mGLXY and mDOT as collateral.

Unknown, how much could have been stolen as a result of the attack, but a new blow to Terra’s reputation could be the last straw, destroying the very idea of the Terra project 2.0.

30 May it became known, that the South Korean prosecutor's office will invite all managers and employees of the Terraform Labs cryptocurrency platform to testify, behind the Terra project.