What happened
Terra's Mirror Protocol was exploited for ~$2 million. This exploit was made possible through validators' usage of outdated oracle software.
The Mirror Protocol was a synthetic assets protocol that allowed users to deposit $USTC or $LUNAC with a lockup period in order to mint synthetic stocks and commodities. It is noteworthy that the new Terra Network was launched within days after the collapse of the Terra Classic Network. The protocol suffered an exploit in the amount of $2 million caused by outdated oracle price feeds. The price feeds used the price of the new Luna Coin instead of the LunaC. While the new Luna coin was trading at a price around 5$ at the time, the $LUNAC coin was practically worthless at a price point of fractions of a cent. This meant that for $1k in $LUNC an attacker could deposit $1,3 million in deposit and borrow against it.
Due to this mechanism, attackers drained several pools on the platform.
Example Transaction: https://finder.terra.money/classic/tx/F830681D8FEACC4DA67E84D40C49F0FF805609F2BB5CCC39A0EFE66257F2D791
Case & protocol details
Audit assessment
Review priorities based on the documented failure pattern in Mirror Protocol (May 2022).
Critical checks
- Verify every sensitive logic path is guarded by appropriate access controls and input validation - see the Oracle Manipulation & Price Manipulation attack class for patterns
- Audit oracle price feeds for manipulation risks - ensure time-weighted average prices (TWAPs) or multi-source aggregators are used, not spot prices
Evidence & learning
Attack pattern
Compare incidents →Sources and on-chain records
- report Report theblock.co
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.