2022-06-09

Incident disclosure 2022-06-09

Summary

We deployed various bond contracts during our launch and one bond deployed in January 10th was not properly disabled. This allowed an attacker to deposit $METIS tokens into the unused bond contract and mint $MAIA.
Upon this issue being detected by our team, the bond was promptly deactivated and all deployed contracts were revised, no other irregularities were detected.

Details of Incident

The attacker first interacted with the bond on 2022-04-25 until this flaw was detected on 2022-06-09. A total of 3983 $MAIA were minted for 1430 $METIS through 17 deposits.

This issue was able to stay undetected for so long due to us migrating from our original Treasury contract which managed bonds to the our current Treasury - Gnosis Multisig Contract.

A very rough estimate, if all the Maia was priced at $23 USDC and Metis at $40. It would mean that the attacker profited $34409 USDC from this exploit via daily redeem + sells to the pool in batches of around 5 $MAIA.

Several accounts were involved in this some interacting with the bonds, others only with the proceeds of the sales.

We are still investigating further and will keep you notified along the way.

Details of Fix

Fixes made:

Pull bonds’ depositor rights from treasury contract.
Revised all of treasury’s permissions.

Next Steps

Decide on the best course of action via governance. This will be split into the two phases, initializing a discussion in discord and then open a proposal via governance.

Timeline of events

Jan 10, 2022 00:39:50 (UTC) Fixed Price Bond is deployed, set at 0.359 Metis per Maia.
Apr 25, 2022 15:18:02 Metis is first deposited into the unused bond. 100 Metis for 278 Maia.
Apr 25, 2022 15:28:02 Second deposit. 25 Metis for 69.6 Maia.
Apr 28, 2022 15:44:32 83 Metis for 231.19 Maia.
Apr 29, 2022 16:11:02 74 Metis for 206.10 Maia.
Apr 30, 2022 18:07:32 69.50 Metis for 193.60 Maia.
May 01, 2022 21:09:02 85.50 Metis for 238.16 Maia.
May 02, 2022 20:26:02 62.90 Metis for 175.40 Maia.
May 03, 2022 20:26:32 74.50 Metis for 207.50 Maia.
May 04, 2022 17:07:07 72.50 Metis for 201.90 Maia.
May 05, 2022 17:58:07 82.00 Metis for 228.40 Maia.
May 08, 2022 18:37:32 117.39 Metis for 327.00 Maia.
May 12, 2022 06:18:02 144.88 Metis for 403.57 Maia.
May 16, 2022 04:04:32 52.08 Metis for 145.08 Maia.
May 16, 2022 09:13:00 69.60 Metis for 193.87 Maia.
May 17, 2022 05:29:32 60.58 Metis for 168.75 Maia.
May 18, 2022 05:12:32 71.91 Metis for 200.32 Maia.
Jun 03, 2022 12:09:02 184.60 Metis for 514.20 Maia.