2022-06-09

Incident disclosure 2022-06-09

Summary

  1. We deployed various bond contracts during our launch and one bond deployed in January 10th was not properly disabled. This allowed an attacker to deposit $METIS tokens into the unused bond contract and mint $MAIA.

  2. Upon this issue being detected by our team, the bond was promptly deactivated and all deployed contracts were revised, no other irregularities were detected.

Details of Incident

The attacker first interacted with the bond on 2022-04-25 until this flaw was detected on 2022-06-09. A total of 3983 $MAIA were minted for 1430 $METIS through 17 deposits.

This issue was able to stay undetected for so long due to us migrating from our original Treasury contract which managed bonds to the our current Treasury - Gnosis Multisig Contract.

A very rough estimate, if all the Maia was priced at $23 USDC and Metis at $40. It would mean that the attacker profited $34409 USDC from this exploit via daily redeem + sells to the pool in batches of around 5 $MAIA.

Several accounts were involved in this some interacting with the bonds, others only with the proceeds of the sales.

We are still investigating further and will keep you notified along the way.

Details of Fix

Fixes made:

  1. Pull bonds’ depositor rights from treasury contract.

  2. Revised all of treasury’s permissions.

Next Steps

Decide on the best course of action via governance. This will be split into the two phases, initializing a discussion in discord and then open a proposal via governance.

Timeline of events

  1. Jan 10, 2022 00:39:50 (UTC) Fixed Price Bond is deployed, set at 0.359 Metis per Maia.

  2. Apr 25, 2022 15:18:02 Metis is first deposited into the unused bond. 100 Metis for 278 Maia.

  3. Apr 25, 2022 15:28:02 Second deposit. 25 Metis for 69.6 Maia.

  4. Apr 28, 2022 15:44:32 83 Metis for 231.19 Maia.

  5. Apr 29, 2022 16:11:02 74 Metis for 206.10 Maia.

  6. Apr 30, 2022 18:07:32 69.50 Metis for 193.60 Maia.

  7. May 01, 2022 21:09:02 85.50 Metis for 238.16 Maia.

  8. May 02, 2022 20:26:02 62.90 Metis for 175.40 Maia.

  9. May 03, 2022 20:26:32 74.50 Metis for 207.50 Maia.

  10. May 04, 2022 17:07:07 72.50 Metis for 201.90 Maia.

  11. May 05, 2022 17:58:07 82.00 Metis for 228.40 Maia.

  12. May 08, 2022 18:37:32 117.39 Metis for 327.00 Maia.

  13. May 12, 2022 06:18:02 144.88 Metis for 403.57 Maia.

  14. May 16, 2022 04:04:32 52.08 Metis for 145.08 Maia.

  15. May 16, 2022 09:13:00 69.60 Metis for 193.87 Maia.

  16. May 17, 2022 05:29:32 60.58 Metis for 168.75 Maia.

  17. May 18, 2022 05:12:32 71.91 Metis for 200.32 Maia.

  18. Jun 03, 2022 12:09:02 184.60 Metis for 514.20 Maia.

Involved Addresses

Treasury

0x3D183E4F3EeF0191eCFfaFd7fFC5Df8D38520Fa9

Bond

0xEc69ecD8D6F1301e4bD9dE5a4e91364B01cDc963

Attacker

0xF9f42491388180b0A5DF58B6c54eF742f8c1863C 0xf613080596F6fC966A6B78B62FA3BF2A232e27D5 0x9Fa2f137bDa5Eae20e1c81a85f4F46d5faD0D09E 0x79B46c9E9Ee39C7Ca1B5cE1BEaE44378509Bde6B 0x7B5Dd791e2D2035B37Be2Ad293E44f10E3FcF110 0x9B4F81e23ba470aDEac89C303B46255a98998b8c 0xbFbc2458ad6b0a03D502A1fb626c9304B6653309

Relevant Transactions

Attacker depositing in bonds

0x06f8ca4c38fb76d7685aa17bff56acd373fd629cbfb86896c8f69f1b5df6c0c5

0xda11cb6586fcb5b8618f67f0c3869033e720086b1b1a454cd8e6791205892336

0xee0facec630e90a6c40bc7ad923b8a90ea20c43739382edc6ad1e0e4a7f11ddb

0x0d9cdf3cfbb8d602a1a197b18d6c56a20c8a673e66577460097650215eab76e0

0x7c3231912c8b230869a86ba7490fa57b33422b71906056a61031be51ea4b6d90

0x21b1224ec616cd3d95d43aa5eb4124a6db7b8fc2809079ff2e3e76983ac8b20e

0xeba67b68e8ec8a71433534999aaf5befca90109a54c41881e40f0d9f4470ce37

0x8f63fe69bcf2e5844c5000ee2eecfce52f5222f005e8b3ac18ba8c979fa95ad7

0x3b9143a808461de481a4f873e75ad7aa9ea250380d537c54587622b3cf3df5a1

0x03fcadd0b8f84ae0a0134b3b15e8b8adbe5d76a0054bf305fbc77cb49f82aa1d

0xa3cbc00f93c5537073768dd0ac1401d2e8065dc260d61dac8ce36dd5e27a0413

0x06d56d848b63bb6b64f88b3af4807f8ff23e89fb2a8bf1d63f3e1f51744649a6

0x00ab7c85fbeacdfb5571eae1e4d5e8f457223d73c2e51a29a34dfd98bb880449

0x7fd313423ab486a458652f31f3ff0abd021b68df31473b137c9c1352dbf800e2

0xc383a88b68a5092112a0232ba5c3789e0d0e18fdf1d476b8706c419e0168cdd0

0x452c91ff2fa9c47ff1802219a2634b926ebf79197047eb5fc46c12eca77f9523

0x43925a4f5385c78d42c1b3f297c6be040abc51c0f75f84a9da9bad279f6f2566

Last updated