Acala Network hack — August 2022

Acala is a Polkadot parachain whose main product was aUSD, a crypto-collateralised stablecoin. On 14 August 2022 a new iBTC/aUSD liquidity pool went live. A parameter belonging to a deprecated reward function in Acala's incentives pallet, DexSavingRewardRates on accumulate_dex_saving, had been misconfigured, so when liquidity providers in the new pool claimed rewards the runtime issued freshly minted aUSD rather than the intended LP rewards. Acala published its incident report the same day.

Acala's own report puts the total error mint at about 3.022 billion aUSD, of which 2.96 billion sat in the addresses of sixteen identified liquidity providers. Roughly 300 addresses ended up holding unbacked tokens, some swapping them through Acala's own DEX at distorted ratios. aUSD lost its peg and traded briefly under one cent. Eight addresses moved value off the parachain before the network was halted, bridging to Moonbeam or swapping into DOT and iBTC and sending those to Polkadot and Interlay.

Governance votes froze the network, and 2.97 billion aUSD of the error mints were recovered from identified addresses and burned. Acala later reported that of 10,961,589 aUSD then in circulation, 5,837,712 still lacked backing. The Acala Foundation opened a collateralised debt position using 3,794,703 USDC and 42.7 million ACA of its own assets, borrowed that amount of aUSD and burned it, and donated further assets to rebalance the pools.

Acala never published a single headline dollar loss. An on-chain analyst quoted at the time put the damage in a range of zero to ten million dollars, most likely around 1.6 million. The Foundation's own re-collateralisation figure of 5,837,712 is the larger and better documented measure and is the figure recorded here. It is denominated in aUSD, which traded between roughly $0.91 and $0.96 during the incident rather than at par, so the true dollar cost was somewhat lower.