blockworks.co
A vulnerability in inter-blockchain communication (IBC) protocol that was patched in April reared its bugly head on the Terra blockchain, late Tuesday.
Onchain data showed an erroneous minting of 58 million ASTRO tokens — worth about $2.7 million — and about $4.1 million in USDC, USDT and wrapped BTC.
Terra conducted an emergency chain upgrade to prevent the vulnerability from affecting other tokens, according to a post on X. The current Terra is the fork that arose following the collapse of the UST stablecoin on what’s now known as the Terra Classic blockchain.
ASTRO is the governance token of Astroport, a decentralized exchange launched in late 2021 on Terra Classic.
The Terra/Luna implosion in May 2022 forced many projects, including Astroport, to rethink their strategies. Astroport pivoted towards a multichain strategy with its primary hub on Neutron, a smart contract blockchain built on the Cosmos SDK.
Swift maneuvers from the Astroport team have reportedly contained the damage from the IBC bug exploit.
Astroport co-lead Donovan Solms commented, “Today was the toughest day [Astroport] has had since the collapse of Terra in ’22. And for a second time, it was due to circumstances outside of our control and our contracts remain unaffected.”
Blockworks requested comments from representatives of Terraform Labs and Neutron.
It’s not immediately clear how the bug, which was discovered and fixed in April, was able to return.
Zaki Manian, co-founder of Sommelier, reported that a June upgrade “accidentally” reintroduced the vulnerability.
Gabriel Shapiro, the general counsel at Delphi Labs, who has closely followed the legal issues facing Terraform Labs (TFL) and its co-founder Do Kwon, suggested the legal case brought by the SEC against TFL, may have indirectly caused the oversight.
Delphi Labs co-founder José Macedo claims to have strong evidence of the attacker’s identity.
The ASTRO token fell by more than -70% following the incident and is currently down about -35% on the day.