Six bugs, one exit, $1.7M lighter: MAYAChain pauses after CACAO caper 🍌

Cross-chain decentralized exchange Maya Protocol halted its network on Aug. 19 after an attacker chained six software flaws to extract an estimated $1.7 million in crypto. The network was paused to prevent further losses, and developers have begun work on a fix to restore swaps, according to pseudonymous co-founder Aalux, who said roughly 20 Bitcoin ($BTC) worth about $1.4 million and $300,000 in additional assets were taken.

A preliminary technical analysis shared by Aalux traced the incident to bugs in trade accounts, outbound transaction handling and liquidity pool calculations. The transaction overwrote records tracking outbound transfers, flagging them as missing and triggering Maya's theft-protection mechanism. The mechanism miscalculated compensation for Maya's low-liquidity Arbitrum Chainlink (ARB.LINK) pool and incorrectly credited it with 49.45 million CACAO, the protocol's gas and settlement token. The intended funding transfer failed because Maya's reserve held insufficient CACAO, but the inflated pool balance persisted.

The attacker then added negligible liquidity, acquired 99.93% of the pool and withdrew 48.87 million CACAO from Asgard, the vault that holds protocol assets. Independent blockchain security researcher Vini Barbosa summarized the findings and reported that CACAO ($CACAO) fell by 88.7%, from approximately $0.115 to $0.013, during the incident.

While the analysis put the attacker's direct haul at about $1.7 million, it estimated that MAYAChain's liquidity pools lost roughly $10.9 million in total value when accounting for arbitrage activity and the collapse in CACAO's price. Maya Protocol is a cross-chain network built on THORChain's open-source code and designed to complement it, with CACAO paired against supported assets in its pools.

Aalux said the team intends to pursue the return of the stolen funds through a bug bounty and is working on restoring liquidity. Cointelegraph reached out to Aalux and the Maya team for additional information and did not receive a response.