Comment on page
2022-06-09
Incident disclosure 2022-06-09
- 1.We deployed various bond contracts during our launch and one bond deployed in January 10th was not properly disabled. This allowed an attacker to deposit $METIS tokens into the unused bond contract and mint $MAIA.
- 2.Upon this issue being detected by our team, the bond was promptly deactivated and all deployed contracts were revised, no other irregularities were detected.
The attacker first interacted with the bond on 2022-04-25 until this flaw was detected on 2022-06-09. A total of 3983 $MAIA were minted for 1430 $METIS through 17 deposits.
This issue was able to stay undetected for so long due to us migrating from our original Treasury contract which managed bonds to the our current Treasury - Gnosis Multisig Contract.
A very rough estimate, if all the Maia was priced at $23 USDC and Metis at $40. It would mean that the attacker profited $34409 USDC from this exploit via daily redeem + sells to the pool in batches of around 5 $MAIA.
Several accounts were involved in this some interacting with the bonds, others only with the proceeds of the sales.
We are still investigating further and will keep you notified along the way.
Fixes made:
- 1.Pull bonds’ depositor rights from treasury contract.
- 2.Revised all of treasury’s permissions.
Decide on the best course of action via governance. This will be split into the two phases, initializing a discussion in discord and then open a proposal via governance.
- 1.Jan 10, 2022 00:39:50 (UTC) Fixed Price Bond is deployed, set at 0.359 Metis per Maia.
- 2.Apr 25, 2022 15:18:02 Metis is first deposited into the unused bond. 100 Metis for 278 Maia.
- 3.Apr 25, 2022 15:28:02 Second deposit. 25 Metis for 69.6 Maia.
- 4.Apr 28, 2022 15:44:32 83 Metis for 231.19 Maia.
- 5.Apr 29, 2022 16:11:02 74 Metis for 206.10 Maia.
- 6.Apr 30, 2022 18:07:32 69.50 Metis for 193.60 Maia.
- 7.May 01, 2022 21:09:02 85.50 Metis for 238.16 Maia.
- 8.May 02, 2022 20:26:02 62.90 Metis for 175.40 Maia.
- 9.May 03, 2022 20:26:32 74.50 Metis for 207.50 Maia.
- 10.May 04, 2022 17:07:07 72.50 Metis for 201.90 Maia.
- 11.May 05, 2022 17:58:07 82.00 Metis for 228.40 Maia.
- 12.May 08, 2022 18:37:32 117.39 Metis for 327.00 Maia.
- 13.May 12, 2022 06:18:02 144.88 Metis for 403.57 Maia.
- 14.May 16, 2022 04:04:32 52.08 Metis for 145.08 Maia.
- 15.May 16, 2022 09:13:00 69.60 Metis for 193.87 Maia.
- 16.May 17, 2022 05:29:32 60.58 Metis for 168.75 Maia.
- 17.May 18, 2022 05:12:32 71.91 Metis for 200.32 Maia.
- 18.Jun 03, 2022 12:09:02 184.60 Metis for 514.20 Maia.
Attacker
0xF9f42491388180b0A5DF58B6c54eF742f8c1863C 0xf613080596F6fC966A6B78B62FA3BF2A232e27D5 0x9Fa2f137bDa5Eae20e1c81a85f4F46d5faD0D09E 0x79B46c9E9Ee39C7Ca1B5cE1BEaE44378509Bde6B 0x7B5Dd791e2D2035B37Be2Ad293E44f10E3FcF110 0x9B4F81e23ba470aDEac89C303B46255a98998b8c 0xbFbc2458ad6b0a03D502A1fb626c9304B6653309
Last modified 1yr ago