New

Hacken is launching a monitoring tool. Get details and join our beta program

More

Manipulations with price oracles. Mirror Protocol Exploit.

Manipulations with price oracles. Mirror Protocol Exploit.
  • Industry News
  • crypto
  • cybersecurity
  • manipulation

31 May 2022

Hackers exploited Mirror Protocol, and the devs couldn’t do anything about it. The attacker stole more than $90m in October 2021 but this incident used to be completely unnoticed until the last week. And at the end of May 2022, the project experienced one more incident resulting in $2M drained from the protocol. A bug in the pricing oracle allowed the hack. We will explain the concept of price oracles and examine their role in Mirror Protocol exploit.

What are price oracles and how do they work

In a broader context, a price oracle is any tool showing an asset’s price. Your app or browser can be a price oracle. But in the context of smart contracts and DeFi protocols, a price oracle is a functional design that the code uses to get the price information about a given asset on-chain. 

Manipulations with price oracles

The most secure on-chain price oracles are highly decentralized, which helps them resist manipulations. However, many developers design their price oracles on an ad-hoc basis paying little attention to security and decentralization. As a result, their ecosystems have lost millions of dollars due to hacks targeting the oracle implementation. 

Mirror Protocol Exploit

On May 30, @FatManTerra discovered the exploit of Mirror Protocol’s price oracle. FatMan said the attacker had already drained $2m and warned that “the attack will get worse when markets open tomorrow.” 

How did it happen?

Most strikingly, the bug that allowed the exploit went unnoticed for eight months. Mirror Protocol lets users take bets against stocks. It was built on Terra. A bet required locking collateral in UST, LUNC, or mAssets for two weeks. The collateral would return after the trade. Yet, Mirror’s smart contract didn’t check whether the same ID was used more than once. On Oct 8th, 2021, the hacker exploited this bug to unlock hundreds of times more collateral.

Mirror Protocol Exploit is rather ironic because it relates to Terra and Luna’s collapse. Terra Classic validators reported the price of the new Terra 2.0 $LUNA ($6.23) coin instead of its worthless predecessor Terra Classic $LUNC ($0.00009). The price oracle software was allegedly outdated: the 1old API endpoints, distribution, supply, and trading market. Two weeks ago, we warned the community that establishing Luna 2.0 would create new opportunities for scammers. This proved to be true. The undynamic and rigid price oracle network of Mirror Protocol could not handle the $LUNA -> $LUNC rebranding.

Responding to the Attack

The $2m-hack could have been prevented with proper coordination and management of price oracles during the $LUNA to $LUNC transfer. DeFi platforms can avoid this exploit with a smart contract audit and bug bounty. These two services help discover critical bugs and faulty price oracle designs before it is too late.

share via social

Subscribe to our research

Enter your email address to subscribe to Hacken Reseach and receive notifications of new posts by email


    Interested in getting to know whether your systems are vulnerable to cyberattacks?

    Tell us about your project

    • This field is required
    • This field is required
      • whatsapp icon WhatsApp
      • telegram icon Telegram
      • wechat icon WeChat
      • signal icon Signal
    • This field is required
    • This field is required
    • This field is required
    • This field is required
    This field is required
    departure icon

    Thank you for your request

    Get security score on

    • certified logo
    • coingeco logo
    • coin market cap logo

    1,070+ projects audited

    companies logos

    Apply for partnership

    • This field is required
    • This field is required
    • This field is required
    • This field is required
      • Foundation
      • VC
      • Angel investments
      • IDO or IEO platform
      • Protocol
      • Blockchain
      • Legal
      • Insurance
      • Development
      • Marketing
      • Influencer
      • Other
    This field is required
    This field is required
    departure icon

    Thank you for your request

    Get security score on

    • certified logo
    • coingeco logo
    • coin market cap logo

    1,070+ projects audited

    companies logos

    Get in touch

    • This field is required
    • This field is required
    • This field is required
    • This field is required
    This field is required
    By submitting this form you agree to the Privacy Policy and information beeing used to contact you
    departure icon

    Thank you for your request

    Get security score on

    • certified logo
    • coingeco logo
    • coin market cap logo