Incident Overview
04 Dec 2024 Vestra DAO on Ethereum was exploited due to a flaw in its staking contract, resulting in the theft of 73,720,000 VSTR tokens (worth ~$378.4K).
The attacker, who had staked 500K VSTR tokens a month earlier, repeatedly invoked the vulnerable unStake function to claim excess VSTR tokens. By exploiting this logical flaw, they conducted transactions involving 500K or 520K VSTR tokens, each yielding 20K VSTR per call. The attacker then transferred the stolen tokens and prioritized their transactions by spending significant gas fees.
This exploit caused the VSTR token's price to drop from $0.013 to $0.005 before a slight recovery to $0.009. Vestra DAO acknowledged the breach, blacklisted the compromised contract, and implemented preventative measures. The incident, however, raised security concerns and damaged the project's reputation.
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Vestra DAO, these are the critical security checks that could have prevented this incident (December 2024).
- Verify all logic paths related to Staking Logic Exploit / Other are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSecurity Audit History
- Audit Report 1 Report
Sources & References
Learn to Prevent the Next Vestra DAO
The Vestra DAO hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.