What happened
On May 31, 2022, Mirror Protocol on Terra Classic was exploited after outdated validator software reported the new Terra 2.0 LUNA price for LUNC collateral. That made near-worthless LUNC appear valuable enough to borrow mAssets with extremely reduced collateral; the analysis cites approximately $2 million drained.
How it happened
- Mirror relied on Terra Classic validator oracle reports to value LUNC collateral.
- Some validators retained outdated software after the Terra fork and reported the new LUNA price, then about $10, instead of LUNC's roughly $0.0001 price.
- Attackers deposited small amounts of LUNC that the oracle overstated and borrowed mAssets against the inflated collateral value.
- CertiK documents an example in which 100,000 LUNC, worth about $10 at market price, was used to borrow 30,275 DOT valued near $300,000.
Protocol details
Classification
Borrowing and Lending / Other / Access Control
Protocol Type
Derivatives
Affected asset / contract
MIR
Implementation language
Rust
Protocol links
Website
@mirror_protocol
Evidence
- report Report theblock.co
- analysis DeFiLlama defillama.com
- analysis Mirror Protocol Exploited Due to Incorrect Oracle Price certik.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
