Acala Network continues operations after burning $2.7 billion in stablecoin aUSD

Following its aUSD stablecoin-related mining fiasco, Acala Network announced on September 26 that it had resumed its operations following a referendum allowing LPs to withdraw liquidity from groups or cancel LP tokens.

The community referendum for Stage 1 of resuming Acala operations has passed and been executed.

LPs who choose to unstake LP tokens or withdraw liquidity on Acala now have the option to do so. https://t.co/yzvOz7zwxT

— Acala (@AcalaNetwork) September 26, 2022

Enhance Acala’s security

In August, a misconfiguration of the iBTC/aUSD Liquidity Pool resulted in the misfacing of $3.022 billion aUSD, bringing its price to $0.01 below the dollar rate.

Acala is a decentralized finance platform built on the Polkadot ecosystem (DOT). The wallet addresses that received the minted aUSD were identified through on-chain tracing, allowing the recovery of 2.97 billion aUSD mistakenly from 16 addresses.

Another 35 accounts were identified as having purchased $12.38 million misfaced. According to the incident report, 16 iBTC/aUSD LP contributors encountered casting errors, and some of them continually added more liquidity to the group, resulting in more miscast aUSD. It notes:

“Some of these users are constantly swapping more aUSD errors as the imbalance of groups increases. They then transfer a significant amount of aUSD errors to chains and CEX connected to XCM.”

The company said the cause of the incident “was a vulnerability in the DEX saving code, which is part of the pallet,” and that the company has also published a security roadmap to enhance Acala’s security.

The report revealed the full extent of the event. A total of 3.022 billion aUSD errors were minted, 2.97 billion aUSD was found in the addresses of 16 LP collaborators that were identified, and 12.38 million aUSD errors were found on the top 35 accounts that had acquired a significant number of aUSD errors or had been linked to accounts that had acquired it.

The remaining $52.068 million in aUSD errors, token swap errors, and addresses related to the problem have been identified.