Vestra DAO Hack

04 Dec 2024 Vestra DAO on Ethereum was exploited due to a flaw in its staking contract, resulting in the theft of 73,720,000 VSTR tokens (worth ~$378.4K).

The attacker, who had staked 500K VSTR tokens a month earlier, repeatedly invoked the vulnerable unStake function to claim excess VSTR tokens. By exploiting this logical flaw, they conducted transactions involving 500K or 520K VSTR tokens, each yielding 20K VSTR per call. The attacker then transferred the stolen tokens and prioritized their transactions by spending significant gas fees.

This exploit caused the VSTR token's price to drop from $0.013 to $0.005 before a slight recovery to $0.009. Vestra DAO acknowledged the breach, blacklisted the compromised contract, and implemented preventative measures. The incident, however, raised security concerns and damaged the project's reputation.

Attack tx:

https://etherscan.io/tx/0xa0dcf9b1…7f1798