Manipulations with price oracles. Mirror Protocol Exploit.

Hackers exploited Mirror Protocol, and the devs couldn’t do anything about it. The attacker stole more than $90m in October 2021 but this incident used to be completely unnoticed until the last week. And at the end of May 2022, the project experienced one more incident resulting in $2M drained from the protocol. A bug in the pricing oracle allowed the hack. We will explain the concept of price oracles and examine their role in Mirror Protocol exploit.

What are price oracles and how do they work

In a broader context, a price oracle is any tool showing an asset’s price. Your app or browser can be a price oracle. But in the context of smart contracts and DeFi protocols, a price oracle is a functional design that the code uses to get the price information about a given asset on-chain. 

Manipulations with price oracles

The most secure on-chain price oracles are highly decentralized, which helps them resist manipulations. However, many developers design their price oracles on an ad-hoc basis paying little attention to security and decentralization. As a result, their ecosystems have lost millions of dollars due to hacks targeting the oracle implementation. 

Mirror Protocol Exploit

On May 30, @FatManTerra discovered the exploit of Mirror Protocol’s price oracle. FatMan said the attacker had already drained $2m and warned that “the attack will get worse when markets open tomorrow.” 

How did it happen?

Most strikingly, the bug that allowed the exploit went unnoticed for eight months. Mirror Protocol lets users take bets against stocks. It was built on Terra. A bet required locking collateral in UST, LUNC, or mAssets for two weeks. The collateral would return after the trade. Yet, Mirror’s smart contract didn’t check whether the same ID was used more than once. On Oct 8th, 2021, the hacker exploited this bug to unlock hundreds of times more collateral.

Mirror Protocol Exploit is rather ironic because it relates to Terra and Luna’s collapse. Terra Classic validators reported the price of the new Terra 2.0 $LUNA ($6.23) coin instead of its worthless predecessor Terra Classic $LUNC ($0.00009). The price oracle software was allegedly outdated: the 1old API endpoints, distribution, supply, and trading market. Two weeks ago, we warned the community that establishing Luna 2.0 would create new opportunities for scammers. This proved to be true. The undynamic and rigid price oracle network of Mirror Protocol could not handle the $LUNA -> $LUNC rebranding.

Responding to the Attack

The $2m-hack could have been prevented with proper coordination and management of price oracles during the $LUNA to $LUNC transfer. DeFi platforms can avoid this exploit with a smart contract audit and bug bounty. These two services help discover critical bugs and faulty price oracle designs before it is too late.