Decentralized finance (DeFi) project Mirror Protocol has been reportedly suffering an ongoing exploit over the past couple of days that allowed bad actors to drain four synthetic asset pools from the protocol, with the potential to drain funds from all other pools in the coming days. Mirror, however, reportedly ‘averted the crisis’. (Updated at 10:30 UTC: Updates in bold.)
Mirror Protocol was not available for comment.
The exploit was possible due to an error on the pricing oracle software for Terra Classic (LUNC) validators. Pseudonymous governance participant ‘Mirroruser’ first reported the incident on May 29 with a post on the Terra Research Forum.
As of now, the mBTC, mDOT, mETH, and mGLXY synthetic asset pools on the protocol have all been drained, losing over USD 2m worth of assets. The attacker will be able to continue exploiting the protocol when the markets open today, according to pseudonymous Terra researcher FatMan.
“Mirror Protocol is being exploited again as we speak, and the devs are completely [missing in action, MIA],” FatMan said on Twitter. “So far, the attacker has drained over [USD] 2m and counting – the attack will get worse when markets open tomorrow unless the dev team steps in and fixes the price oracle.”
The researcher detailed that due to an error in the pricing oracle, Luna Classic (LUNC) is priced around UST 5, while it’s actually worth less than a fraction of a cent. “For [USDg 1k in LUNC, an attacker can now load up on [USD] 1.3m in collateral but can pull out real assets by borrowing,” FatMan said.
@stablekwon @mirror_protocol Please look into fixing the LUNC price oracle, because in a short while, all liquidity pools will be drained, Mirror will accrue irremediable bad debt, and the system will collapse in on itself. This is not the time to be negligent. (4/4)— FatMan (@FatManTerra) May 30, 2022
The Mirror Protocol is a decentralized finance project that allows users to create and trade “mirrored assets,” or mAssets, which “mirror” the price of stocks, including major tech stocks like Apple and Microsoft.
FatMan warned that the Mirror Protocol is on the verge of collapse as developers have done “nothing” to fix the issue. They also asked users to withdraw all their funds from the protocol.