Stars Arena Hack

Stars Arena, an Avalanche-based project, was exploited through a reentrancy attack, leading to a loss of 2,974,530 USD worth 266,102 AVAX.

Stars Arena is a social platform on the Avalanche chain. On October 7, 2023, the platform suffered a reentrancy attack. The attacker drained funds from the Stars Arena contract, amounting to 2,974,530 USD (266,102 AVAX).

The Attacker created a contract that distributed the stolen funds to many addresses, sending 1,000 AVAX each. During the call of the 0xe9ccf3a3 function, the attacker reentered and called the 0x5632b2e4 function, setting a block height. This height was then used as a parameter in the sellShares function, resulting in an abnormally large calculated amount of AVAX to send.

Attacker Address:

Address 0xa2eb…ad7a

Malicious Transaction:

Tx 0x4f37…7ac5

Malicious Contract:

Address 0x7f28…c7ac

Funds Distribution Transactions:

Tx 0x8f5b…9fb1

Some of the Stolen Funds Holders:

Address 0x9b5e…418d

Address 0xded4…6b3e