MAYAChain halts network after estimated $1.7M exploit

Maya Protocol, a cross-chain decentralized exchange (DEX), temporarily shut down its network following a significant exploit that resulted in an estimated loss of $1.7 million in cryptocurrency. The incident, which occurred on Wednesday, was traced back to six interconnected bugs within the platform's system.

Pseudonymous co-founder Aalux of Maya Protocol disclosed that the attacker managed to steal around 20 Bitcoin, valued at $1.4 million, alongside an additional $300,000 worth of assets. Following the incident, Maya Protocol swiftly implemented a global halt to prevent further damage and subsequently began working on a resolution to restore normal operations.

A preliminary technical analysis, conducted by Aalux, identified the root cause of the exploit as six chained bugs. These bugs were primarily related to trade accounts, outbound transaction handling, and liquidity pool calculations. The attacker leveraged a single transaction consisting of 23 messages to manipulate the system. First, the attacker triggered a false theft detection, subsequently inflated a low-liquidity pool, and ultimately withdrew 48.87 million CACAO tokens from Maya's Asgard module.

The analysis calculated that approximately $1.36 million was transferred to external blockchains, while the attacker retained about $291,000 in CACAO tokens and trade-account positions on MAYAChain. Independent blockchain security researcher Vini Barbosa corroborated these findings, noting that the value of CACAO plummeted by 88.7%, falling from around $0.115 to $0.013 during the incident.

The report further estimated a total loss of $10.9 million in pool value, although this figure encompassed additional factors such as arbitrage activity and the devaluation of CACAO, rather than solely representing the assets stolen by the attacker.