What happened
On October 8, 2021, an attacker exploited Mirror Protocol's Terra Classic short-position lock contract and withdrew approximately $90 million in USTC. The loss was not publicly identified until May 2022. This was a duplicate-position-ID withdrawal bug, unrelated to the separate oracle incident that affected Mirror later in May 2022.
A batched withdrawal path did not enforce uniqueness of user-supplied position IDs before aggregating value. Storage deletion did not prevent previously constructed duplicate entries from being summed. Batch redemption and withdrawal functions must validate ID uniqueness before calculating transfers or mutating state. Mirror's later patch rejected duplicate position_idx values.
Case & protocol details
Attack Timeline
The attacker seeded the lock contract with USTC before opening short positions, causing a position's calculated locked amount to include the pre-existing contract balance. unlock_positions_funds built eligible entries from user-supplied position IDs and summed them before removing the underlying locks. It did not reject duplicate IDs.
The attacker supplied the same eligible position repeatedly, so each materialized duplicate entry contributed its locked amount to the total. BlockSec observed position 43186 repeated 437 times in one call, producing about 43.7 million USTC, with other positions abused similarly.
Evidence & learning
Sources and on-chain records
- report Report twitter.com
- report The Block Mirror incident report theblock.co
- transaction Transaction finder.terra.money
- code Code reference github.com
- analysis Website reference blocksecteam.medium.com
- analysis Website reference theblock.co
- analysis BlockSec Mirror Protocol exploit analysis blocksec.com
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.