Maya Protocol has halted MAYAChain after an attacker exploited six software flaws to remove about $1.7m (£1.3m) in bitcoin and other digital assets, while the wider impact of the incident pushed the value of its liquidity pools down by an estimated $10.9m.
A preliminary reconstruction indicates that the attacker combined a series of separate weaknesses in the cross-chain trading network. Together, the flaws allowed the system to credit a liquidity pool with almost 50 million tokens despite those tokens never having been properly funded.
That artificial credit created the conditions for real assets to be withdrawn from the network. The attacker was then able to drain bitcoin and other assets held by the protocol.
The direct theft was considerably smaller than the overall loss suffered by the network. Following the exploit, arbitrage activity and a sell-off in CACAO contributed to a sharp fall in the value of Maya’s liquidity pools.
CACAO, Maya Protocol’s native token, fell by almost 89%, according to the report. The combined effect of the attack and the market reaction reduced the estimated value of assets held in Maya’s pools by about $10.9m.
The incident also highlighted how a number of relatively narrow technical problems can combine to create a much more serious failure. The preliminary analysis identified six flaws that worked in sequence rather than one single vulnerability responsible for the whole exploit.
Among the failures was a false theft alert, which affected the network’s response to activity on the chain. The system also handled outgoing transactions incorrectly and used faulty calculations when determining the balances and value of its liquidity pools.
Those issues allowed the attacker to manipulate the protocol’s accounting. By exploiting the way the network recorded and assessed transactions, the attacker was able to make the system recognise assets that had not actually been deposited in the necessary way.
The resulting imbalance made it possible to withdraw genuine assets from the pools. Maya Protocol subsequently halted MAYAChain while the incident was assessed.
Bitcoin was listed at $64,295.90, up 0.25%, in related market information accompanying the report.
The material also referenced Zcash’s Tachyon upgrade, which is intended to scale shielded payments, improve readiness for possible quantum threats and test whether the project’s funding, security and governance arrangements can withstand those demands.
The Maya Protocol incident demonstrates the risks created when accounting, transaction processing and liquidity-pool mechanisms interact improperly. The attack was not dependent on one broad system failure; instead, the attacker chained together several bugs, with the combined effect allowing a much larger loss than any of the individual weaknesses might have suggested.
