Stars Arena Hack

Stars Arena, an Avalanche-based project, was exploited through a reentrancy attack, leading to a loss of 2,974,530 USD worth 266,102 AVAX.

Stars Arena is a social platform on the Avalanche chain. On October 7, 2023, the platform suffered a reentrancy attack. The attacker drained funds from the Stars Arena contract, amounting to 2,974,530 USD (266,102 AVAX).

The Attacker created a contract that distributed the stolen funds to many addresses, sending 1,000 AVAX each. During the call of the 0xe9ccf3a3 function, the attacker reentered and called the 0x5632b2e4 function, setting a block height. This height was then used as a parameter in the sellShares function, resulting in an abnormally large calculated amount of AVAX to send.

Attacker Address:

https://cchain.explorer.avax.network/address/0xa2ebf3fc…b4ad7a

Malicious Transaction:

https://cchain.explorer.avax.network/tx/0x4f37ffec…e17ac5

Malicious Contract:

https://cchain.explorer.avax.network/address/0x7f283edc…d2c7ac

Funds Distribution Transactions:

https://snowtrace.io/tx/0x8f5b2e88…ef9fb1

Some of the Stolen Funds Holders:

https://cchain.explorer.avax.network/address/0x9b5ec83e…2d418d

https://cchain.explorer.avax.network/address/0xded436c2…c56b3e