On Wednesday, Terra developers temporarily halted network operations due to a reentrancy attack, resulting in the theft of over $4 million in various tokens from the blockchain. The network was paused at block height 11430400 to implement an emergency patch that fixed the vulnerability. The fix was completed by 04:19 UTC, with validators, who are responsible for supporting the network, upgrading their nodes to prevent future exploits. Over 67% of the voting power on Terra supported this upgrade, ensuring the network’s stability and security.
Details of the Attack
Security firm Beosin reported that the attack led to the theft of $3.5 million in USDC stablecoin, $500,000 in USDT stablecoin, 2.7 bitcoins (BTC), and more than 60 million of Astroport’s ASTRO tokens. Beosin explained that the attacker exploited a reentrancy vulnerability in the timeout callback of ibc-hooks, a vulnerability that had been disclosed in April. This type of bug allows exploiters to trick a smart contract by making repeated calls to a protocol to steal assets, thereby authorizing the smart contract address to interact with a user’s wallet address.
Impact on Tokens and Market Reaction
In the aftermath of the attack, ASTRO, the native token of the Cosmos liquidity protocol Astroport, experienced a significant decline. CoinGecko data indicated that ASTRO fell by 56%. Meanwhile, Terra’s luna classic (LUNC) tokens saw a 3.4% decrease in the past 24 hours. The exploit caused ASTRO’s price to drop sharply from $0.046 to a low of $0.013, although it later recovered to above $0.02 as efforts to address the vulnerability continued.
Response from Terra and Astroport Teams
On July 31, Terra blockchain announced the temporary halt of operations at block height 11430400 and informed users of the downtime via a post on X. The Astroport team confirmed the incident, attributing it to an IBC vulnerability. They noted that the exploit appeared to have been used to mint several tokens on the Terra chain, including ASTRO. With the blockchain halted, no further tokens could be minted, limiting the extent of the damage.
Terra blockchain was exploited for ~60M $ASTRO, 3.5M $USDC, 500k $USDT, and 2.7 $BTC.
The attacker exploited a reentrancy vulnerability in the timeout callback of ibc-hooks. The vulnerability was disclosed in April this year:https://t.co/CY39X28KyE https://t.co/hY9xA40hbJ
— Beosin Alert (@BeosinAlert) July 31, 2024
IBC, or inter-blockchain communication protocol, is an open-source protocol that allows for authentication and data transfer across multiple chains. This protocol enables users to access various decentralized applications and services on different blockchains. The halt of the Terra chain was prompted by a report from blockchain security firm Cyvers, which revealed that 60 million ASTRO tokens had been stolen in the exploit. This also affected other tokens, including 3.5 million USDC, 2.7 BTC, and 500,000 USDT.
🚨ALERT🚨@terra_money was exploited, resulting in the theft of approximately 60M $ASTRO, 3.5M $USDC, 500K $USDT, and 2.7 $BTC.
The attacker took advantage of a reentrancy vulnerability in the timeout callback of ibc-hooks.
This vulnerability was revealed in April of this year.… https://t.co/56oTpg78Cv— 🚨 Cyvers Alerts 🚨 (@CyversAlerts) July 31, 2024
Ongoing Efforts to Secure the Network
The sharp decline in ASTRO’s price highlighted the market’s reaction to the exploit. The token’s price initially plummeted but has since shown some recovery as the involved teams work diligently to patch the vulnerability. The combined efforts of Terra developers, validators, and the Astroport team aim to restore confidence in the network’s security and prevent similar incidents in the future.
Ensuring Future Security
The reentrancy attack on Terra underscores the importance of robust security measures in blockchain technology. By exploiting a known vulnerability, the attacker was able to cause significant financial damage and disrupt network operations. The swift response from Terra and its partners highlights the commitment to maintaining a secure and reliable blockchain environment. Moving forward, ongoing vigilance and continuous improvement of security protocols will be essential to protect against similar threats and ensure the stability of blockchain ecosystems.