On May 31, a Twitter account named FatMan, Terra analyst and source of several whistleblower leaks, stated that the Mirror Protocol is vulnerable and may crash in the next few hours.
Specifically, according to FatMan, the latest exploit has allegedly drained over $2 million, with the potential for more, due to a bug in the LUNC pricing oracle. LUNC token (old LUNA) price is considered $5 when the actual price is only 1/100 of 1 cent. Attackers can thus easily mortgage LUNC to withdraw the real assets of the project.
FatMan claimed that the buggy oracle is threatening to drain the liquidity of the mBTC, mETH, mDOT, and mGLXY pools, which have been tokenized on Mirror.
This Twitter account also warned that once the US stock market trades again after the Memorial Day holiday on May 31, attackers will be able to drain all of the mAsset pools.
FatMan urges Do Kwon, Terraform Labs CEO, and Mirror development team to quickly fix this oracle bug.
Mirror Protocol is a sub-project of Terraform Labs, which has been alleged by the US SEC for providing US stock trading products to US investors without registering. The two have been caught up in a legal battle ever since.
The Mirror Protocol website is currently inaccessible. Meanwhile, DeFi site Llama reports the project’s TVL is now close to $190.00, down almost 100% from $704 million at the beginning of May.
Previously, in early May, FatMan also accused the Mirror Protocol team had quietly patched a vulnerability that had been backlog for 7 months and caused the protocol to drain nearly $90 million.
Follow our channels for more crypto news: