What happened
On December 17, 2023, an attacker exploited a race condition in the off-chain marketplace of Aurory, a Solana-based game, and used it to withdraw about 600,000 AURY (roughly $830,000 at the time) through the SyncSpace bridge to Arbitrum. By sending several marketplace buy requests at the same time, the attacker got the seller side credited twice while the buyer was debited only once, inflating their AURY balance in SyncSpace.
The withdrawn AURY was paid out from an Aurory team wallet and sold on the AURY-USDC pool on Camelot, whose liquidity fell about 80%, from $1.5 million to $312,000. AURY dropped about 17% to $1.17. Aurory disabled SyncSpace deposits and withdrawals, bought back tokens to absorb the selling, and said no user funds or NFTs were lost. OtterSec, which had audited Aurory, said the issue was outside the scope of its audit.
On Arbitrum, the exploit transaction 0x61f6ab7869524f921ed23d2c7bf16a7735fc0379463ca2ee0eea2d72ab9588c6 was sent at 18:28 UTC on December 17, 2023 from the attacker address 0xec79BC14F4781e46d746Fe4A5F7A5346Bc57D514 and transferred 550,000 AURY to it from contract 0x4e0E24B960286bE46eCf92986Bef548604601d77.
How it happened
- The attacker sent several buy requests to Aurory's off-chain marketplace buy endpoint at the same time.
- Because the endpoint did not serialize these concurrent purchases, the seller side was credited for each request while the buyer was debited only once, inflating the attacker's AURY balance in SyncSpace.
- The attacker withdrew about 600,000 AURY from SyncSpace to Arbitrum. Accounts that had never deposited AURY were funded from an Aurory team wallet.
- The AURY was sold into the AURY-USDC pool on Camelot, removing about 80% of its liquidity, until Aurory disabled the SyncSpace bridge.
Protocol details
Evidence
- report @AuroryProject incident report twitter.com
- transaction Arbitrum transaction 0x61f6ab78...9588c6 arbiscan.io
- transaction arbiscan.io transaction tx arbiscan.io
- transaction arbiscan.io transaction 0xd850…a97c arbiscan.io
- transaction etherscan.io transaction 0xc560…61b3 etherscan.io
- analysis Web Archive archive.ph
- analysis Solana Game 'Aurory' Suffers $830K Exploit, Disables Arbitrum Bridge decrypt.co
- analysis Solana Hacks, Bugs, and Exploits: A Complete History helius.dev
- analysis Solana-based ecosystem Aurory loses 80% of pool's liquidity crypto.news
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
