Acala Swap Hack

A misconfigured liquidity pool on Acala Swap lead to exponential minting of the Acala Dollar. Quick actors were able to transfer $1,6 million in good value off-chain.

The Acala Network lives on the Polkadot Network and focusses on its decentralized stablecoin aUSD. On the 14th of August an Acala community member reported the detection of unusual on-chain activity. The new iBTC/aUSD pool had just gone live on Acala swap and due to an error in the code, users triggered the minting of aUSD to their wallets when trying to claim the rewards of their liquidity pool position. $1.3 billion aUSD were minted within a short time frame.

The protocol could be paused through an urgent governance proposal. The error has since been fixed and the team is still actively tracing the erroneously minted aUSD on-chain.

Acala has established a list of recovery wallets and the biggest recipient of this error with $aUSD 1.2 billion received is cooperating with the team.

Detailed breakdown of involved addresses

https://hackmd.io/@xlc/SkN2HdDA9