Terra-based Mirror Protocol suffered an exploit that saw an unknown attacker drain over $2 million. The issue was signaled last night by FatMan, a pseudonymous Terra sleuth who gained a large following as a vocal critic of Terra’s decisions following the depegging of UST and collapse of LUNA (now known as LUNC).
According to FatMan, by the time the exploit was discovered, the attacker had drained the mBTC, mETH, and mDOT pools. This morning, they added, the exploit was about to morph into a collapse of the entire protocol as the attacker waited to “drain all of the mAsset pools,” including mSPY, mAAPL, mAMZN.
FatMan called on Mirror and Terra teams to act immediately to get Terra Classic validators updated so they begin reporting the price of LUNA, Terra’s new token, which currently sits at around $8, rather than LUNC, which trades for a fraction of a penny.
The price feed issue has since been fixed, but as another pseudonymous whistleblower, Rizman Zoom, tweeted a few hours ago, the value of some mAssets had already fallen sharply below the oracle price, which would allow attackers to acquire cheap collateral to mint other mAssets on Mirror, initiating a spiral.
To avert the disaster, Mirror stopped mBTC, mETH, mGLXY and mDOT from being used as collateral, “probably” saving the protocol.
No Mirror developer commented on the matter as of press time. The news comes hot on the heels of the discovery of another exploit the Mirror Protocol suffered in October 2021, tracked down by FatMan and reported by The Block.
