What happened
On December 4, 2024, a logic error in Vestra DAO's Ethereum staking contract let an attacker repeatedly claim yield from a position that had already been unstaked. QuillAudits reports an approximately $500,000 token loss after the attacker used an initial 500,000 VSTR stake and repeated unStake calls.
How it happened
- About one month before the attack, the attacker staked 500,000 VSTR and waited for its lock period.
- The attacker unstaked the position, receiving the principal and its first yield payment.
- The contract had marked the position inactive but did not check that status on later unStake calls.
- The attacker repeatedly claimed another 20,000 VSTR in yield, using fresh accounts or contracts to keep aggregate staking values high enough to continue.
Protocol details
Classification
Protocol Logic / Other
Protocol Type
Exploit/Other
Implementation language
Solidity
Protocol links
Website
@Vestra_DAO
Evidence
- report @_czepluch incident report x.com
- report @TenArmorAlert incident report x.com
- analysis Website reference binance.com
- analysis DeFiLlama defillama.com
- analysis Decoding Vestra DAO’s $500K Exploit quillaudits.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
