MAYAChain’s $1.36 million exploit spiraled into nearly $11 million of pool damage
MAYAChain’s attacker moved about $1.36 million in onerous belongings to exterior chains, whereas the estimated impression throughout the community’s liquidity swimming pools approached $11 million.
The $1.36 million determine tracks belongings that left the system, together with roughly 20.83 BTC. The bigger estimate captures a cascade contained in the swimming pools: false accounting created an enormous CACAO stability, that stability turned withdrawable, and CACAO’s subsequent collapse repriced the community’s remaining liquidity.
Maya Protocol operates MAYAChain as a cross-chain liquidity community the place customers commerce in opposition to pooled belongings. Its CACAO token connects these markets, which allowed a failure that started in a single pool to unfold via the worth recorded elsewhere.
Founder Aaluxx said on Aug. 18 that the crew would repair the incident and “recuperate in full.” As of the Aug. 20 reporting cutoff, Maya’s official channels had not but revealed a confirmed swap restart, the patch deployed on mainnet, an asset-recovery whole, a remaining loss allocation, or complete compensation phrases for liquidity suppliers.
How an unfunded stability turned withdrawable
The exploit turned an accounting entry that the reserve might by no means fund into a liquidity place the attacker might use.
Independent researcher Vini Barbosa traced most of the activity to at least one MsgDeposit transaction containing 23 messages. In his reconstruction, the ultimate DONATE message overwrote earlier ObservedTxVoter state, together with the outbound peak used to match transactions.
That unsuitable peak made MAYAChain classify authentic outbound transfers as lacking. The classification activated theft-detection logic designed to compensate a pool after a lacking switch.
The compensation path then calculated a subsidy for a near-empty ARB pool with out bounding the quantity to the pool’s depth. Barbosa stated the calculation recorded roughly 49.45 million CACAO of worth despite the fact that the reserve held solely about 168,000 CACAO.
The reserve lacked sufficient tokens to finish the module switch, however the brand new pool state had already been dedicated. According to Barbosa, the handler continued after the failed switch and left the inflated stability in place.
The attacker added a negligible quantity of liquidity to the distorted pool and obtained about 99.93% of its possession items, enabling a withdrawal of roughly 48.87 million CACAO.
The overwritten peak produced false theft detection, the false sign generated an extreme subsidy, the failed subsidy survived in pool data, and the recorded stability then supported a dominant liquidity declare.
Barbosa’s reconstruction attributes the exploit to that mixed path. He put onerous belongings moved to exterior chains at about $1.36 million, led by 20.83 BTC. His estimate for the network-wide impression was near $11 million.
The token fell from about $0.115 to $0.013 in the course of the incident, an 88.7% drop.
CACAO represents one aspect of MAYAChain’s paired liquidity swimming pools. A pointy decline in its greenback value reduces the measured worth of CACAO stock throughout the system, even when these tokens stay inside a pool.
The exploit-created stability and trades executed in opposition to distorted pool costs added one other layer of pool impression.
The unique attacker’s exterior haul and the worth misplaced throughout the swimming pools are separate measures. One follows belongings despatched out of MAYAChain, whereas the opposite captures how an accounting failure modified the worth and composition of liquidity that remained obtainable to suppliers.
Maya had but to publish a remaining ledger dividing the whole amongst hard-asset extraction, CACAO repricing, and trades made in the course of the dislocation. The scale and course of the multiplier are clear, whereas an actual greenback allocation for every class stays pending.
For liquidity suppliers, that distinction determines what restoration would require. Replacing 20.83 BTC would restore one set of belongings, whereas pool accounting, CACAO valuation, and the allocation of buying and selling losses would nonetheless want their very own remedy.
What “recuperate in full” has to cowl
A full restoration has at the least three elements: returning or changing onerous belongings, repairing pool balances, and defining how the remaining impression is allotted amongst liquidity suppliers and different individuals.
Maya’s network-halt documentation says HALTTRADING stops buying and selling whereas MAYAChain can proceed producing blocks. Chain liveness exhibits that consensus is operating, however swap availability is dependent upon the buying and selling controls.
By Aug. 20, Maya’s public channels had but to produce the confirmed restart time, deployed patch model, recovered-asset whole, remaining pool calculation, and liquidity-provider compensation scope wanted to show the restoration promise into an outlined settlement.
MAYANode’s public historical past exhibits that its Trade Accounts implementation drew from THORChain merge requests. That establishes shared improvement lineage round Trade Accounts.
The full MAYAChain exploit relied on a number of situations aligning throughout transaction state, outbound matching, subsidy calculations, pool-state ordering, and rollback conduct. Public documentation as of press time didn’t exhibit that THORChain carries that very same full path.
MAYAChain’s loss multiplier is as a lot an accounting and market construction story as a theft story. The attacker moved about $1.36 million in onerous belongings, however the false stability modified pool possession and arrived alongside an 88.7% collapse within the token connecting the community’s markets.
For liquidity suppliers, the decisive replace shall be Maya’s definition of “full”: which belongings return, how pool balances are rebuilt, and who absorbs the worth modifications and trades that restoration can’t merely rewind.
The put up MAYAChain’s $1.36 million exploit spiraled into nearly $11 million of pool damage appeared first on CryptoSlate.
