Stars Arena Exploited For Estimated $2.9M In Security Attack

Just a day after Stars Arena being exposed to a non-critical bug, it has suffered a major security breach which drained the whole TVL from the contract.

The Avalanche based protocol has shared on its official Twitter (X) account that its smart contract is attacked. It has also said to users to avoid depositing funds.

There has been a major security breach with the smart contract.

We're actively checking the issue.

DO NOT deposit any funds.

Stay tuned for updates.
— The Arena (@TheArenaApp) October 7, 2023

According to data by DeFiLlama, Stars Arena had a TVL (total value locked) of nearly $2.8 million on October 7 which all has been drained in the attack.

Zrocq9Nudpgxtdszyozi0Dz6Ra1Y2Chxsmjpcemsw Fdfuiju5Nmvyzp Yddaxiew5Uysn8I6Gfsorqadqd7Bkh7Xsg0L Loaatfay579Ghpfqswskkcmkjwyyk1Nzkufbgcokikpwcyrz6Miorc1U — Stars Arena TVL – DeFiLlama

Blockchain security firm PeckShield identified the attack and explained that hackers have abused reentrancy in Stars Arena smart contract. By doing so, hackers have updated weight when the profile share is issued which enables selling a share at a much higher price of 274k AVAX.

Stars Arena was launched a couple of weeks ago and it recorded immense growth by surpassing $1 million TVL within days.