Starstream / Agora Hack

The Starstream project was exploited on 532M $STARS tokens, which were then placed on Agora DeFi, where assets including $METIS, $WETH and $MUSDC were borrowed. Total losses amounted to ~$15M.

Starstream is a suite of products for providing yield aggregation and yield generation on the Metis L2 rollup.

The attacker used the external function execute(), the Distributortreasury contract, which allowed sending $STARS tokens to the attacker's address. The attacker then deposited the stolen $STARS tokens in Agora DeFi loan contracts and leveraged assets, including $METIS, $WETH, and $MUSDC. The attacker used an Exchange Proxy to move the funds to the Ethereum blockchain before sending funds to Tornado.cash. In total the attacker sent 900 $ETH to Tornado.cash. The attacker then returned 120 $ETH back to METIS network via the Metis Andromeda Bridge.

As the time of this writing information on this case is scarce. More sources will be added if the case should develop.

Attacker addresses:

ETH: https://etherscan.io/address/0xffd90c77…ac9c48

METIS: https://andromeda-explorer.metis.io/address/0xFFD90C77…ac9C48/transactions

0x Exchange proxy transaction: https://etherscan.io/tx/0xd72b46cf…58858d

Tornado.cash deposit example transactions:

https://etherscan.io/tx/0x4f112e10…28125d

https://etherscan.io/tx/0x80a3aad3…bf15d0

https://etherscan.io/tx/0x596cdfe1…26aca6