Stars Arena hack — October 2023

On 7 October 2023 Stars Arena, an Avalanche-based SocialFi application modelled on friend.tech, lost 266,103 AVAX from its shares contract. The application let users buy and sell "shares" in individual accounts along a bonding curve.

CertiK's analysis describes a reentrancy sequence. The attacker deposited 1 AVAX, and because the contract used native-coin transfers the deposit handed control to the attacker's contract mid-execution. Before the outer call finished, the attacker re-entered and altered a weighted multiplier used in share price calculation, then called sellShares(), which read the modified value and paid out 274,332 AVAX. The proceeds were split across roughly 266 freshly created addresses holding about 1,000 AVAX each. The same address had already taken about $2,000 from the platform on 5 October through a separate flaw; Ava Labs founder Emin Gun Sirer had publicly described that earlier issue as already fixed and as having netted the attacker only $2,000.

Valuations differ. CertiK put the 266,103 AVAX at about $2.88 million, while PeckShield, cited by The Block, gave 266,104 AVAX worth about $2.9 million, and CoinDesk reported roughly $3 million. Stars Arena's own message described a "major security breach" and told users not to deposit funds, without giving a figure.

Stars Arena then negotiated with the attacker. The Block reported that 239,493 AVAX, about 90 percent of the total, was returned across two transactions, and that the hacker received a bounty of 27,610 AVAX. User wallets were not affected; the loss was confined to funds held by the contract.