Lucky Star Hack

Reported loss $297K
Access Control

What happened

Lucky Star Currency (LSC), an astrology-themed NFT project on BNB Chain, was drained a second time on March 22, 2024. About $297,000 in LSC and USDT was taken from users who had previously approved the project's proxy admin contract to move their tokens. The project had already been called an exit scam by CertiK in October 2023, when about $1.1M of LSC was withdrawn by the contract owner.

According to CertiK, the project deployer transferred ownership of the proxy admin to a malicious address, which upgraded the LSC proxy to a new implementation and used users' existing approvals to transfer out their LSC and USDT. Whether the deployer acted deliberately or its key was taken by someone else is not established; trackers labelled it a second rug pull.

On-chain references:

  • Deployer: 0xcde285a531b35d40f4e92a1a6677b991fee4cd01
  • Ownership transfer tx: 0xbb2e8abb11ac2bc5a862f7660c52cca5d6815ed24d11fbe2fb7bc676967e8d61
  • Malicious upgrade tx: 0xb5e79163d1d84835bf3b771274bcde19be306f0882e57b939a129e84f38df523, sent from 0x4b657cbcefab301ae2a5a161649ed0da20dcfb77
  • Proxy admin: 0x6b2ee1995da5eaf6caa8aed3f849265a4c2b80ca
  • Proxy contract: 0x077e1E0c96cBbFB604c8bF191C2849A196E7c9eb
  • Malicious implementation (unverified source): 0x32e484A199D29Ee1A8f47d9f9DD11Fe9B74222A9

How it happened

  1. Users of Lucky Star Currency had granted token approvals for LSC and USDT to the project's upgradeable contract system.
  2. At about 15:03 UTC on March 22, 2024, the deployer 0xcde285...cd01 called transferOwnership on the ProxyAdmin 0x6b2ee1...80ca, handing it to a new address.
  3. About a minute later, 0x4b657c...fb77 called upgradeAndCall on the ProxyAdmin, pointing the LSC proxy at a new implementation with unverified source code.
  4. The new code used the approvals users had already given to transfer their LSC and USDT out, about $297,000 in total.

Protocol details

Classification Other
Protocol Type Exploit/Access control
Affected asset / contract LCS
Protocol links Website

Evidence

Understand the attack patterns

Compare incidents →
Access Control Attacks

Same attack technique

Browse all hacks →
Holdstation $192K lost Beets $3.0M lost Chris Larsen $112M lost HTX $21.9M lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes