What happened
On Oct. 30, 2024, Sunray Finance, a DEX and perpetuals protocol on Arbitrum, was drained of about $2.7M to $2.86M. CertiK reported that a private key had been compromised. The attacker used it to take control of the protocol's SUN and ARC tokens, minted huge amounts, and dumped them into the DEX pairs. According to CertiK, about $2.855M was stolen and moved to 0xC4059d92f941e1d1fB631f6358A41A9De4eccC9A.
On-chain reporting shows that the attacker first upgraded the protocol's management contract to a malicious implementation, then minted SUN. One swap of the newly minted SUN pulled more than $2.1M in USDT out of a liquidity pool, and further swaps took WETH. Security firm TenArmor said a leaked private key most likely made the upgrade possible. Sunray said the incident involved a sudden issuance of treasury SUN and ARC tokens and that user assets were still on-chain. An arbitrage bot also profited by buying the dumped SUN and selling it into a second pool.
How it happened
- The attacker gained control of a privileged Sunray key that could upgrade contracts. CertiK and TenArmor attribute this to a compromised or leaked private key.
- The attacker deployed a malicious contract on Arbitrum and upgraded Sunray's management contract to use it.
- With the new implementation in place, the attacker minted an enormous supply of SUN. CertiK also reports ARC being minted.
- The attacker swapped the minted tokens into Sunray's DEX pairs. The largest swap took more than $2.1M in USDT, and further swaps took WETH, draining the pairs' real liquidity.
- The proceeds were consolidated at the attacker address reported by CertiK.
Protocol details
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
