Starstream / Agora Hack

Reported loss $15.0M
Ethereum
Other

What happened

On April 7, 2022, an attacker drained about 532 million STARS from the Starstream Finance treasury on Metis through an unprotected execute() function in Starstream's new DistributorTreasury contract. The attacker then used the stolen STARS as collateral on Agora DeFi, a lending market on Metis, and borrowed about $8.2 million in METIS, WETH and mUSDC. CertiK puts the total loss across both protocols at about $15 million.

The borrowed funds were bridged to Ethereum, and 900 ETH was sent to Tornado Cash. No recovery was reported, and CertiK says the protocol wound down on June 9, 2022.

How it happened

  1. Starstream's DistributorTreasury contract exposed an external execute() function that made an arbitrary low-level call and had no access control.
  2. The attacker called execute() to make DistributorTreasury invoke the privileged withdrawTokens function on StarstreamTreasury, which trusted DistributorTreasury. This moved about 532 million STARS to the attacker.
  3. The attacker deposited the STARS into Agora DeFi's lending contracts as collateral and borrowed about $8.2 million of METIS, WETH and mUSDC.
  4. The borrowed assets were moved to Ethereum through an exchange proxy, and 900 ETH was sent to Tornado Cash. About 120 ETH was later bridged back to Metis.

Protocol details

Classification Yield Aggregator / Rugpull
Protocol Type Exploit/Other
Affected asset / contract STARS
Protocol links Website @starstreamfin

Security review history

  • Solidity Finance 2022-02-03 No public report

Evidence

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes