{"investigation":{"slug":"mars-perps","entity_name":"Mars Perps","trust_score":28,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"Mars Perps was the perpetual futures product of Mars Protocol, deployed on the Neutron outpost of the Cosmos ecosystem. On December 14, 2025, the protocol suffered a mechanism design exploit that drained $973,079 USDC from lending depositors via skew-based same-block arbitrage. The exploit ultimately triggered a full protocol wind-down, which concluded in March 2026 with user funds returned and community channels closed.","sections":[{"content":"Mars Perps was the perpetual futures trading component of Mars Protocol, a lending and borrowing platform originally launched on the Terra blockchain in March 2022. Following Terra's collapse in May 2022, Mars Protocol migrated to the Cosmos ecosystem, launching Mars Hub as an independent Cosmos application chain in January 2023. The perps product was later deployed on the Neutron outpost, utilizing an oracle-based execution model rather than a traditional order book. Trades were settled in USDC, and the system supported up to 10x leverage with cross-margin and cross-collateral functionality through NFT-based credit accounts. The Perps Vault acted as the counterparty to all trades. Mars Protocol maintained a separate, unaffected outpost on Osmosis, which continued operating normally through the incident period. Mars Protocol received a $3 million USDC grant from the Neutron Foundation over two years, with Mars granting 60,000,000 MARS tokens to Neutron in exchange.","heading":"Protocol Overview","sources":[{"url":"https://docs.marsprotocol.io/perpetual-futures-perps","name":"docs.marsprotocol.io","type":"other","credibility":3},{"url":"https://defillama.com/protocol/mars-perps","name":"defillama.com","type":"other","credibility":3},{"url":"https://marsprotocol.io/","name":"marsprotocol.io","type":"other","credibility":3},{"url":"https://defi-planet.com/2022/12/introducing-the-mars-protocol-an-open-source-protocol-on-cosmos/","name":"defi-planet.com","type":"other","credibility":3},{"url":"https://forum.neutron.org/t/proposal-26-make-neutron-the-home-of-mars-protocol/233","name":"forum.neutron.org","type":"other","credibility":3}],"severity":"medium"},{"content":"On December 14, 2025, the Mars Perps market on Neutron was exploited in a protocol logic attack that extracted $973,079 USDC in a matter of minutes. Unlike many prior attacks on oracle-based perp protocols that manipulated price feeds, this exploit targeted three interrelated mechanism design flaws. First, skew-based pricing allowed the attacker to generate risk-free profit through same-block arbitrage, as the direction of the skew fee could be exploited by opening and immediately closing opposing positions. Second, funding rates were not applied within the same block, eliminating the economic penalty that would otherwise deter this arbitrage. Third, losses sustained by the Perps Vault were passed directly to lending depositors, meaning passive USDC lenders became the exit liquidity for the attack. The attacker looped this pattern 15 times using an initial $49,783.92 USDC to extract approximately $973,000, a return of roughly 19.5x on capital deployed. Two attack contracts were deployed at Neutron addresses neutron1a2724e7mgs7xlxpw4gmwuth5uvddd7299n9qpps9nk523fgq0lksnfx022 and neutron123pa8s9mfzlw6u4kv88qpdma8uqp00d62pcdutvq63uc9l9elteq6afhyw. The exploiting address was neutron14uk0xh7qf0q65f96x506yjjagya7wrx4hy3kvp. Approximately $960,000 in bad debt was recorded, isolated to the USDC lending market on the Neutron outpost.","heading":"December 2025 Security Exploit","sources":[{"url":"https://www.range.org/blog/tracking-the-mars-protocol-exploit","name":"range.org","type":"other","credibility":3},{"url":"https://x.com/mars_protocol/status/2000283619361800307","name":"x.com","type":"other","credibility":3},{"url":"https://x.com/Airdrops_one/status/2000655118598111417","name":"x.com","type":"other","credibility":3},{"url":"https://coinmarketcal.com/en/event/perps-security-incident-309902","name":"coinmarketcal.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the exploit, the attacker moved the stolen $973,079 USDC off Neutron within minutes via a five-hop cross-chain route involving no mixers, no token swaps, and no privacy tools. The funds moved from Neutron via IBC bridge to Noble, then via Circle's Cross-Chain Transfer Protocol (CCTP) to Base, then through three intermediate Base wallet addresses — 0xff88979bcbb579008debc5d6c108221804ee44b5, 0xF9df867a4558cE0D3E030f71926295B48a7Ef89B, 0x2736A134c88AEBd921908f0f534600D05f57b1A4, and 0xf966921c6a34f895d54809b5ad17b546bde1a88a — before arriving at the Binance hot wallet address 0xEe7aE85f2Fe2239E27D9c1E23fFFe168D63b4055. The directness of the fund movement to a centralized exchange suggests a degree of confidence by the attacker or a failure to anticipate traceability. Pre-attack funding for the operation was staged via Tornado Cash: the attacker made ten ETH deposits totaling 16.22 ETH, with seven of these deposits occurring approximately one month before the exploit, indicating the attack was premeditated and prepared over a significant period. Mars Protocol publicly flagged the attacker's addresses and stated it was attempting to establish contact with the responsible party to explore a potential negotiated return of funds.","heading":"Fund Flow and Attribution","sources":[{"url":"https://www.range.org/blog/tracking-the-mars-protocol-exploit","name":"range.org","type":"other","credibility":3},{"url":"https://x.com/mars_protocol/status/2000514949974757686","name":"x.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the exploit, Mars Protocol and the Neutron Foundation coordinated a remediation effort for affected lending depositors. The Neutron Foundation deployed supplemental relief funding on a voluntary basis, contributing 80,000 USDC from the final milestone of its grant to the Mars Protocol Foundation, plus approximately 20,600 USDC from the Revenue Share DAO fund, for a total of approximately 100,600 USDC. Based on estimates at the time of the remediation plan, 96.48% of affected users were projected to receive full reimbursement once the combined Mars and Neutron distributions were applied. Larger positions faced potential partial reimbursement due to finite recovery resources. A remediation claim portal was launched on January 28, 2026, with a 30-day claiming window through February 27, 2026. The governance proposal MRC-164 formalized the exploit response and action plan in the Mars Protocol governance forum.","heading":"Remediation and Compensation","sources":[{"url":"https://coinmarketcal.com/en/event/remediation-portal-live-315451","name":"coinmarketcal.com","type":"other","credibility":3},{"url":"https://x.com/neutron_org/status/2016529265165008994","name":"x.com","type":"other","credibility":3},{"url":"https://forum.marsprotocol.io/t/mrc-164-update-on-exploit-response-and-action-plan/1579","name":"forum.marsprotocol.io","type":"other","credibility":3}],"severity":"medium"},{"content":"The December 2025 exploit proved fatal to the protocol's continuation. Following the incident, the Mars Protocol Foundation concluded that ongoing operation could not meet its standards for user safety and protocol integrity. Governance proposal MRC-165, which put the structured wind-down to a community vote, was approved following a 5-day forum discussion and a 3-day on-chain vote, with execution commencing on February 24, 2026. The wind-down was structured as a 24-day deleveraging cascade: liquidation loan-to-value ratios across all assets were reduced by approximately 3% per day, giving borrowers time to repay, add collateral, or close positions voluntarily. On approximately March 21, 2026, all liquidation LTVs were set to 0, remaining borrow positions were liquidated, and final debt clearance and fund distribution were executed. The Mars Protocol Foundation operated through March 23, 2026. All user funds held in credit accounts or in Mars v1 were returned directly to user wallets. Mars Protocol's official Discord and Telegram channels were subsequently closed, and no further support or updates have been provided. The protocol has ceased operations.","heading":"Protocol Wind-Down and Shutdown","sources":[{"url":"https://www.tradingview.com/news/coinmarketcal:380ab1cae094b:0-mars-protocol-mars-mrc-165-vote-21-24-february-2026/","name":"tradingview.com","type":"other","credibility":3},{"url":"https://x.com/mars_protocol/status/2038919794108326247","name":"x.com","type":"other","credibility":3},{"url":"https://www.ainvest.com/news/mars-protocol-wind-flow-analysis-final-deleveraging-2603/","name":"ainvest.com","type":"other","credibility":3},{"url":"https://www.rootdata.com/news/595304","name":"rootdata.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Mars Protocol engaged two security firms, Halborn and Oak Security, for audits of its core CosmWasm smart contracts. Halborn conducted a security assessment beginning February 14, 2022 and ending February 18, 2022, covering the mars-council, mars-red-bank, and mars-vesting contracts. Oak Security, which holds experience auditing Cosmos SDK, Terra, and Substrate projects, conducted complementary audits of similar scope. Mars contributors publicly disclosed these audit reports, and all identified vulnerabilities were reportedly fixed or formally acknowledged. Mars v2 Rovers also passed a successful Oak Security audit. However, the December 2025 exploit was not a code vulnerability of the type typically caught by smart contract audits; it was a mechanism design flaw in the economic incentives of the perps system — specifically the interaction between skew-based pricing, same-block funding rate application, and vault loss socialization. It is not confirmed whether the perps contracts specifically underwent a dedicated audit that evaluated these mechanism-level risks.","heading":"Security Audit History","sources":[{"url":"https://blog.marsprotocol.io/blog/declassifying-mars-protocols-security-audits-from-halborn-and-oak-security","name":"blog.marsprotocol.io","type":"other","credibility":3},{"url":"https://www.halborn.com/audits/mars-protocol","name":"halborn.com","type":"other","credibility":3},{"url":"https://www.halborn.com/audits/mars-protocol/mars-protocol-core-contracts-updated-code-cosmwasm-smart-contract-security-assessment","name":"halborn.com","type":"other","credibility":3},{"url":"https://docs.marsprotocol.io/mars-protocol/security-and-risks/audits","name":"docs.marsprotocol.io","type":"other","credibility":3}],"severity":"medium"},{"content":"Mars Protocol's origins place it among the DeFi protocols most severely affected by the Terra/LUNA collapse of May 2022. At its peak on the Terra blockchain, Mars Protocol reported approximately $350 million in total value locked, representing roughly 1.8% of Terra's total TVL of $18.74 billion. The TerraUSD (UST) depeg event in May 2022 resulted in a combined $1.2 billion decline in TVL across Mars Protocol and the Astroport exchange. The protocol survived by migrating to a sovereign Cosmos application chain rather than remaining on Terra 2.0, issuing MARS tokens via airdrop to eligible Terra Classic holders at two historical snapshots. This migration, while preserving the protocol, reset its user base and TVL position. The protocol's track record of surviving a major ecosystem collapse, then suffering a fatal mechanism exploit three years later, reflects an elevated risk history for a DeFi lending and perps platform.","heading":"Terra Collapse Exposure","sources":[{"url":"https://geeklay.com/the-mars-protocol-leaves-terra-2-0-in-favor-of-the-cosmos-ecosystem/","name":"geeklay.com","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/terra-lending-protocol-mars-to-launch-mainnet/amp","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://defi-planet.com/2022/12/introducing-the-mars-protocol-an-open-source-protocol-on-cosmos/","name":"defi-planet.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2022-03","event":"Mars Protocol launches on the Terra blockchain with a lending and borrowing product; TVL peaks near $350 million.","source":"","date_original":"2022-03-01"},{"date":"2022-05","event":"Terra/LUNA ecosystem collapses. Mars Protocol loses the majority of its TVL. Combined $1.2 billion TVL decline across Mars and Astroport.","source":"","date_original":"2022-05-01"},{"date":"2022-12","event":"Mars Protocol announces migration from Terra to the Cosmos ecosystem as a sovereign application chain.","source":"","date_original":"2022-12-01"},{"date":"2023-01-31","event":"Mars Hub launches as an independent Cosmos application chain; MARS tokens distributed via airdrop to eligible Terra Classic holders.","source":""},{"date":"2025-11-14","event":"Attacker begins pre-staging operation via Tornado Cash, making seven ETH deposits approximately one month before the exploit.","source":""},{"date":"2025-12-14","event":"Mars Perps exploit executed on Neutron outpost. Attacker uses skew-based arbitrage to drain $973,079 USDC using $49,783 initial capital. Funds exit to Binance in five cross-chain hops. Mars Protocol disables all perps contracts.","source":""},{"date":"2025-12-14","event":"Mars Protocol publicly flags attacker addresses and announces investigation. Neutron outpost on Osmosis confirmed unaffected.","source":""},{"date":"2026-01-28","event":"Mars Protocol and Neutron Foundation launch remediation claim portal for affected USDC lending depositors. Claiming window open through February 27, 2026.","source":""},{"date":"2026-02-21","event":"Governance vote on MRC-165 (protocol wind-down) opens. Vote runs from February 21 to February 24, 2026.","source":""},{"date":"2026-02-24","event":"MRC-165 passes. Structured wind-down execution commences. Liquidation LTVs begin declining approximately 3% per day.","source":""},{"date":"2026-03-21","event":"All liquidation LTVs set to 0. Remaining borrow positions liquidated. Final debt clearance and fund distribution executed.","source":""},{"date":"2026-03-23","event":"Mars Protocol Foundation ceases operations. Discord and Telegram channels closed. Protocol wind-down confirmed complete; all user funds returned to wallets.","source":""}],"sources_used":[{"url":"https://docs.marsprotocol.io/perpetual-futures-perps","name":"docs.marsprotocol.io","type":"other","archive_url":"http://web.archive.org/web/20260212000910/https://docs.marsprotocol.io/perpetual-futures-perps","credibility":3,"archive_timestamp":"2026-02-12T00:09:10+00:00"},{"url":"https://defillama.com/protocol/mars-perps","name":"defillama.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://marsprotocol.io/","name":"marsprotocol.io","type":"other","archive_url":"http://web.archive.org/web/20260314113606/https://marsprotocol.io/","credibility":3,"archive_timestamp":"2026-03-14T11:36:06+00:00"},{"url":"https://defi-planet.com/2022/12/introducing-the-mars-protocol-an-open-source-protocol-on-cosmos/","name":"defi-planet.com","type":"other","archive_url":"http://web.archive.org/web/20260829031419/https://defi-planet.com/2022/12/introducing-the-mars-protocol-an-open-source-protocol-on-cosmos/","credibility":3,"archive_timestamp":"2026-08-29T03:14:19+00:00"},{"url":"https://forum.neutron.org/t/proposal-26-make-neutron-the-home-of-mars-protocol/233","name":"forum.neutron.org","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.range.org/blog/tracking-the-mars-protocol-exploit","name":"range.org","type":"other","archive_url":"http://web.archive.org/web/20260413014220/https://www.range.org/blog/tracking-the-mars-protocol-exploit","credibility":3,"archive_timestamp":"2026-04-13T01:42:20+00:00"},{"url":"https://x.com/mars_protocol/status/2000283619361800307","name":"x.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://x.com/Airdrops_one/status/2000655118598111417","name":"x.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://coinmarketcal.com/en/event/perps-security-incident-309902","name":"coinmarketcal.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://x.com/mars_protocol/status/2000514949974757686","name":"x.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://coinmarketcal.com/en/event/remediation-portal-live-315451","name":"coinmarketcal.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://x.com/neutron_org/status/2016529265165008994","name":"x.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://forum.marsprotocol.io/t/mrc-164-update-on-exploit-response-and-action-plan/1579","name":"forum.marsprotocol.io","type":"other","archive_url":"http://web.archive.org/web/20260123110152/https://forum.marsprotocol.io/t/mrc-164-update-on-exploit-response-and-action-plan/1579","credibility":3,"archive_timestamp":"2026-01-23T11:01:52+00:00"},{"url":"https://www.tradingview.com/news/coinmarketcal:380ab1cae094b:0-mars-protocol-mars-mrc-165-vote-21-24-february-2026/","name":"tradingview.com","type":"other","archive_url":"http://web.archive.org/web/20260302031056/https://www.tradingview.com/news/coinmarketcal%3A380ab1cae094b%3A0-mars-protocol-mars-mrc-165-vote-21-24-february-2026/","credibility":3,"archive_timestamp":"2026-03-02T03:10:56+00:00"},{"url":"https://x.com/mars_protocol/status/2038919794108326247","name":"x.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.ainvest.com/news/mars-protocol-wind-flow-analysis-final-deleveraging-2603/","name":"ainvest.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.rootdata.com/news/595304","name":"rootdata.com","type":"other","archive_url":"https://web.archive.org/web/20260830035228/https://www.rootdata.com/news/595304","credibility":3,"archive_timestamp":"2026-08-30T03:52:28+00:00"},{"url":"https://blog.marsprotocol.io/blog/declassifying-mars-protocols-security-audits-from-halborn-and-oak-security","name":"blog.marsprotocol.io","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-job","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.halborn.com/audits/mars-protocol","name":"halborn.com","type":"other","archive_url":"http://web.archive.org/web/20260315170532/https://www.halborn.com/audits/mars-protocol","credibility":3,"archive_timestamp":"2026-03-15T17:05:32+00:00"},{"url":"https://www.halborn.com/audits/mars-protocol/mars-protocol-core-contracts-updated-code-cosmwasm-smart-contract-security-assessment","name":"halborn.com","type":"other","archive_url":"http://web.archive.org/web/20260414120552/https://www.halborn.com/audits/mars-protocol/mars-protocol-core-contracts-updated-code-cosmwasm-smart-contract-security-assessment","credibility":3,"archive_timestamp":"2026-04-14T12:05:52+00:00"},{"url":"https://docs.marsprotocol.io/mars-protocol/security-and-risks/audits","name":"docs.marsprotocol.io","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-job","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://geeklay.com/the-mars-protocol-leaves-terra-2-0-in-favor-of-the-cosmos-ecosystem/","name":"geeklay.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-job","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://cointelegraph.com/news/terra-lending-protocol-mars-to-launch-mainnet/amp","name":"cointelegraph.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:19.86363+00:00","updated_at":"2026-08-30T03:54:58.853405+00:00"}}