Startale Hack

Reported loss $3K
Ethereum
Improper Access Control

What happened

In September 2026, an attacker drained pre-funded Startale smart accounts on Ethereum. The flaw was in how the accounts guarded initialization. The Startale smart account (ERC-7579, used for ERC-4337 account abstraction) used an EIP-1153 transient-storage flag as its only initialization check. The flag was set in the proxy constructor and was meant to live only during deployment. Transient storage actually lasts for the whole transaction, so right after the factory deployed an account, anyone could call initializeAccount() on it again in the same transaction. That second call ran an attacker-chosen bootstrap contract through delegatecall inside the account, which swept its balance.

The drain ran as roughly 41 batched transactions. The reported total is about $2,876 in USDC and USDT across roughly 330 victim accounts. One example batch, 0x1a021a27c8db5ecd6428a567cedf008872f205c55e590d4dcd2ea10e31a036a2, took 427.55 USDC from 23 accounts. The attack needed no signature, no privileged role and no attacker capital.

How it happened

  1. Users pre-funded counterfactual Startale accounts, sending USDC or USDT to each account's predicted address before the account contract was deployed.
  2. The attacker EOA 0x901DafdE7057BC2478d1eF640fb5515EA4757AAB deployed a throwaway contract whose constructor did all the work. In the example transaction, the factory emitted 40 AccountCreated events, each followed by the normal owner registration in the ECDSA validator.
  3. Each deployment set INIT_SLOT to 1 with tstore inside the AccountProxy constructor. The flag stayed set after the constructor returned because transient storage is cleared only at the end of the transaction.
  4. In the same transaction, the attacker's contract called initializeAccount() again on each new account with its own bootstrap address. requireInitializable() only read the transient flag, and there was no persistent already-initialized check, so the call passed.
  5. The malicious bootstrap ran through delegatecall in the account's context and sent the pre-funded balance to the collector 0xe2719E3b28EeF69bf3C4A9D7FC7280c5a015EcdE. The 23 funded accounts in the example batch lost 427.55 USDC in total.

Protocol details

Classification Access Control
Protocol Type DeFi Protocol
Implementation language Solidity

Evidence

Understand the attack patterns

Compare incidents →
Access Control Attacks

Same attack technique

Browse all hacks →
Radix Radix $1.2M lost Bouncebit BounceBit $3.0M lost Avalanche ChainConnect $650K lost Ethereum SUPERFORTUNE AI $15.2M lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes