TERRA MONEY

DESCRIPTION OF EVENTS

"Terra is a blockchain protocol and payment platform used for algorithmic stablecoins. The project was created in 2018 by Terraform Labs, a startup co-founded by Do Kwon and Daniel Shin. It was best known for its Terra stablecoin and the associated LUNA reserve asset cryptocurrency."

"Terra hosts a vibrant ecosystem of diverse products and services. Create a Station wallet to start exploring and interacting with an array of ecosystem applications. With Pulsar Finance, the leading Web3 portfolio tracker, you can effortlessly monitor all your tokens, DeFi positions, and NFTs across Terra and over 100 other blockchains."

"Fueled by the passionate #LUNAtic community and deep developer talent pool, the Terra blockchain is built to enable the next generation of Web3 products and services. Build crypto's next killer app using Terra's suite of developer tools and resources."

"Terra was hard forked from the Terra Classic network following a major financial collapse in 2022, which was triggered by its algorithmic stablecoin, UST, losing its supposed peg to the US dollar."

"The vulnerability was identified a few months ago and patched across the Cosmos ecosystem in April. However, a later upgrade in June on Terra failed to include this patch, leading to renewed exposure and the subsequent exploit, Zaki Manian, co-founder of Sommelier Protocol, explained."

"This bug was known as the IBC reentrancy infinite mint bug, and all Cosmos chains issued an emergency patch to remediate this issue."

"In April 2024 theIBC-Go library issued an emergency patch for the reentrancy bug. The affected version that is relevant to Terra is < 7.4.0. Terra was utilizing a custom version of IBC-Go 7.3.1 at the time of the attack (github.com/terra-money/ibc-go/v7 v7.3.1-terra.0) that was vulnerable to the exploit."

"In April 2024 theIBC-Go library issued an emergency patch for the reentrancy bug. The affected version that is relevant to Terra is < 7.4.0. Terra was utilizing a custom version of IBC-Go 7.3.1 at the time of the attack (github.com/terra-money/ibc-go/v7 v7.3.1-terra.0) that was vulnerable to the exploit."

"According to Zaki Manian, co-founder of Sommelier Finance, although the vulnerability was patched in the Cosmos ecosystem back in April, Terra did not include this patch in their June upgrade, resulting in the vulnerability being re-exposed and exploited."

"Terra blockchain experienced a security breach that led to the theft of tokens. The attackers exploited a known vulnerability related to the third-party module IBC hooks, stealing the value of cross-chain assets, including USDC stablecoins and Astroport tokens. The Terra team has taken emergency measures to prevent further losses and coordinated with validators to apply a patch to fix the vulnerability."

"“There was a vulnerability in IBC hooks discovered by Composable Finance in April. It was patched across Cosmos. Terra was patched then,” Manian told The Block. “It appears that Terra's June upgrade did not include the patch. All the Axelar USDC bridged to Terra was stolen using the IBC hooks exploit. A large amount of ASTRO was also stolen.""

"Attention Terra users: Please be advised that the chain will be halted shortly at block height 11430400 and transactions will not be processed during this time.

We will be working with the validators on Terra (phoenix-1) to apply an emergency patch thereafter to remediate a suspected exploit."

"The Terra chain has resumed block production at approximately 4:19 AM UTC today and the emergency chain upgrade is now complete.

Transactions are now being processed, and users may resume normal activities.

Validators holding over 67% of the voting power on Terra have upgraded their nodes to prevent the exploit from recurring. More validators are expected to upgrade soon."

"After these events, both the Terra and Astroport teams took swift action to lessen the impact of the attack. The Terra team upgraded the IBC-Go version appropriately and also introduced a new blacklist antehandler. This will effectively add a step to the transaction pre-processing to see if the transaction signer is on a list of blacklisted addresses, and if so, it will block the transaction. It is important to note that this blacklist only has one address, and it is the ibc-exploiter’s terra address that is holding around $650,000 USD in stolen funds, mainly consisting of 20,000,000 ASTRO. These funds are now locked and are out of circulation.

The Astroport team was able to seize the ASTRO in the attacker's Neutron wallet because ASTRO recently migrated from a cw20 Terra token to a tokenfactory denom on Neutron. This gives the token admin unique privileges to recover the funds. This was accomplished through a force transfer from the attacker's Neutron wallet. It should be noted that this action was only possible on the origin chain of the Astro token (Neutron in this case) and would not have been possible if the token versions were wrapped."

The Terra blockchain is a hard fork of the original Terra Luna blockchain which crashed due to a failure of the algorithmic stablecoin UST. An emergency patch was issued for a critical reentrancy vulnerability in April to all blockchains which are part of the Cosmos ecosystem. Unfortunately, Terra did not upgrade their protocol to apply the patch. It was exploited to take millions of dollars worth of assets. Some assets have been recaptured so far.

SlowMist Hacked - SlowMist Zone (Aug 8)
https://www.theblock.co/post/308440/attacker-exploits-ibc-hooks-vulnerability-to-steal-tokens-on-terra-blockchain (Aug 12)
Terra (Aug 12)
Terra (blockchain) - Wikipedia (Aug 12)
@terra_money Twitter (Aug 6)
Terra hit by $6 million loss as attacker exploits vulnerability known since April (Aug 6)
@BeosinAlert Twitter (Aug 6)
Terra Blockchain Restarts After Reentrancy Attack Leads to $4M Exploit (Aug 12)
@terra_money Twitter (Aug 12)
Terra Blockchain Restarts After $4M Exploit | Currency News | Financial and Business News | Markets Insider (Aug 12)
Terra Blockchain Hack: $6.8 Million Stolen, ASTRO Plummets 60% (Aug 12)
Terra IBC Hooks Exploit Analysis - Range Security (Aug 12)
ASA-2024-007: Potential Reentrancy using Timeout Callbacks in ibc-hooks · Advisory · cosmos/ibc-go · GitHub (Aug 6)
Ethereum Transaction Hash (Txhash) Details | Etherscan  (Aug 12)
Ethereum Transaction Hash (Txhash) Details | Etherscan  (Aug 12)

More case studies

AstroPort Malicious
CosmWasm Reentrancy Attack

Humanity Protocol
Discord Malicious Links