DeFi Digest: Hacker siphons $90m from Mirror as Tron rises 48%

The decentralised finance (DeFi) sector continues to attract heightened attention from cryptocurrency investors. ForkLog has compiled the most important events and news of the past weeks into this digest.

Key metrics for the DeFi segment

The total value locked (TVL) in DeFi protocols fell to $106.3 billion. The leader is MakerDAO with a figure of $9.45 billion, while second and third places are held by Curve ($8.67 billion) and AAVE ($8.23 billion), respectively.

TVL in Ethereum-based applications declined to $68.2 billion. Over the past 30 days the figure fell by 38% (the May 4 reading stood at $110 billion).

Trading volume on decentralised exchanges (DEX) over the last 30 days amounted to $98.1 billion.

Uniswap continues to dominate the non-custodial exchange market — accounting for 74.7% of total trading volume. The second DEX by volume is Curve (11.3%), the third is Balancer.

In May, the Tron DeFi ecosystem grew by 48%

In May, the TVL of the Tron-based decentralised applications ecosystem Tron rose by more than 48%, surpassing $6 billion.

In the overall DeFi Llama ranking the project trails only Ethereum and BNB Chain, with figures of $68.24 billion and $8.41 billion respectively.

Other top-10 ecosystems saw significant declines. For example, Avalanche -52.9%, Solana -42.7%.

Hacker siphoned $90m from Mirror Protocol

Operating on Terra, the Mirror DeFi Protocol fell victim to an exploit worth more than $90 million. It was discovered by analyst FatMan and confirmed by cybersecurity firm BlockSec.

To open a short position on a synthetic stock in Mirror Protocol, one must lock collateral (UST, LUNA Classic and mAssets) for at least 14 days. After the position is closed, the tokens can be withdrawn back to the wallet.

To establish asset ownership, a smart-contract-generated identifier was used. Due to the vulnerability the protocol could not lock multiple withdrawals by the same user. In October 2021, an unknown actor detected this vulnerability—a loss totalling $90 million, an amount hundreds of times greater than the collateral they had locked.

BlockSec explained that this only became known now, as Mirror’s site did not display data on the amount of collateral users had deposited. Another factor was the community’s relatively low attention to on-chain data analysis for Terra compared with Ethereum and EVM-compatible networks.

In May, a few days after Terra’s collapse, Mirror Protocol developers fixed the exploit. On the community forum, the team left unanswered whether anyone had exploited the vulnerability.

At the end of the month an unknown actor withdrew another $2 million from Mirror due to oracle price display issues. This vulnerability was found by a community member, Mirroruser, and confirmed by FatMan.

Most validators on the Terra Classic network were running an outdated version of the oracles. The latest provided price data for LUNA Classic (LUNC) at a rate of 5 USTC (~$0.12), while the real price did not exceed $0.0001. As a result the attacker drained several liquidity pools (mBTC, mETH, mDOT and mGLXY).

An analyst warned that the hacker could similarly target the mAsset pools, potentially amassing bad debt and triggering a protocol collapse. Access to them was suspended until the start of the pre-market trading session for equities.

The situation was “saved” by the weekend and the United States Memorial Day holiday on May 30, when the stock market was closed.

The developers listened to the expert’s advice. They disabled the use of mBTC, mETH, galaxy and mDOT as collateral, preventing a potential “catastrophe.” As a result, the attacker lost the ability to drain liquidity pools.

Trading on Uniswap exceeds $1 trillion since DEX launch

Trading volume on Uniswap surpassed in aggregate the equivalent of $1 trillion since the DEX launched in 2018.

According to Uniswap Labs, the number of protocol users has approached 3.9 million — more than 80% of all participants in the DeFi space.

When looking at DEX trading volumes across networks, Uniswap’s share (across all versions) stands at 42.5%, according to CoinGecko. Its closest rival PancakeSwap on BNB Chain accounts for 8.3%.

The Monetary Authority of Singapore to study DeFi protocols

The Monetary Authority of Singapore will study the possibilities of DeFi protocols and tokenisation. The Guardian project will also involve JPMorgan, Marketnote and DBS.

Financial institutions will work out use cases in four key areas:

• open and interoperable networks;
• trust anchors;
• tokenisation of assets;
• institutional-grade DeFi protocols.

The first pilot project envisages creating a permissioned liquidity pool. It will consist of tokenised shares and deposits used to provide secured loans via smart contracts.

“These early studies of DeFi-solutions will ensure Singapore’s competitiveness as a leading financial centre,” said Han Kui Huan, head of the Strategic Planning Group at DBS.

Polygon launches accelerator programme for DeFi projects

The Layer-2 Ethereum-scale solution platform Polygon launched a new accelerator programme for developers in the DeFi space.

The initiative is implemented in collaboration with Layer-3 blockchain infrastructure provider Orbs on the basis of the DeFi.org accelerator.

The programme focuses on projects using the partners’ core technologies.

“A focus on DeFi applications at both L2 and L3 — the next step for builders passionate about developing on Ethereum,” the statement reads.

Participants will build solutions on Polygon. They will receive funding, mentorship and marketing assistance. DeFi.org will provide liquidity inflows for promising projects, as well as promotion through its website and other platforms.

Also on ForkLog:

• Symbiosis presented a tool for automatic liquidity provision into DeFi protocol pools.

Read ForkLog’s Bitcoin news in our Telegram — cryptocurrency news, prices and analysis.