Mirror Protocol and Oracle Vulnerability

AirdropMMO

Jun 1

Terra's Mirror Protocol has another vulnerability, threatening to withdraw cash

After Anchor Protocol, the Mirror Protocol project was the next to encounter oracle problems after Terra 2.0 released.

On the morning of May 31, the Twitter account FatMan, a character who frequently criticizes and discloses inside information about the "shady" behavior of the Terraform Labs team before, during and after the "catastrophe" of LUNAUST, continued to assert that Cloning protocols are vulnerable and may crash in the next few hours.

According to FatMan, Mirror Protocol encountered an oracle error, displaying the wrong property value, which broke the protocol. Therefore, Mirror assumes that the price of the LUNC token (old LUNA) is $5, while the actual price is only 1/100 of a cent. Therefore, an attacker can easily collateralize LUNC to withdraw the real assets of the project.

FatMan claims that the bad guys quickly discovered the security flaw and drained the liquidity from the mBTC, mETH, mDOT and mGLXY pools, which were encrypted on the Mirror. This person warned, once the US stock market resumes trading after the Memorial Day holiday at around 8:30 a.m. on May 31 (Vietnam time), the bad guys can withdraw all the money from the old vaults.

FatMan urges Terraform Labs CEO Do Kwon and Mirror development team to quickly fix this oracle. Mirror Protocol is a subproject of Terraform Labs, which has been "beaten" by the US SEC for providing US stock trading products to US investors, but has not yet registered with that agency. The two have been embroiled in a legal battle ever since.

The Mirror Protocol website is currently inaccessible. Meanwhile, DeFi site Llama reports that its Project Foreclosure (TVL) Value is now close to $190.00, down nearly 100% from $704 million at the beginning of May.

Mirror Protocol TVL volatility, data extracted from DeFi Llama at 9:30 a.m. on May 31, 2022

Another project that was at the heart of the old Terra ecosystem, Anchor Protocol, recently encountered the same oracle error because it didn't change the price reference from the old LUNA to LUNC, the new name of the piece after Terraform Labs deploy it. The new blockchain is Terra 2.0 and bears the name LUNA for the main coin of the network. It can be seen that after Terra 2.0 was released, many of the above application development teams are busy switching to the new blockchain, forgetting their products on the old blockchain.

Before that, FatMan was also the one who announced in early May that the Mirror Protocol team had silently patched the security hole for 7 months, causing this protocol to lose nearly $ 90 million without even knowing it.

The price of Mirror Protocol's MIR token didn't see much of a negative move in the wake of the news, but also because the coin dropped over 60% in May and is currently experiencing extremely low trading volumes.