Stars Arena, a platform based on the Avalanche blockchain, has suffered 2 major attacks in just a few days, resulting in several million dollars in losses. Although the application’s smart contract has been completely emptied, Stars Arena’s teams have announced that the platform will soon be relaunched with all of its users’ funds restored.
Stars Arena victim of a second attack in a few days
Stars Arena, a fork version of friend.tech hosted on the Avalanche blockchain, was drained of almost $3 million shortly after its launch due to a flaw in one of its smart contracts.
This, knowing that 2 days earlier, Stars Arena had already been robbed of $2,000 for a similar flaw. While the project teams defended themselves by claiming that malicious actors had carried out a “coordinated attack” against them, many observers, notably 0xlilitch and 0xfoobar, virulently attacked Stars Arena.
0xfoobar, for example, the founder of Delegate, accused them of copying a functional smart contract and adding attack opportunities:
“You’ve taken a fully functional base contract and somehow added new attack vectors into your unverified fork. Delete your account and product, it’s a circus. “
Like its competitor friend.tech, Stars Arena allows users to acquire shares in the profiles of celebrities featured on the application. The more people with Shares in a given profile, the higher the price of a Share in that profile.
This time, according to blockchain security firm PeckShield, the attacker carried out a reentrance attack, enabling him to resell Shares at prices far higher than their actual price.
Our initial analysis on today’s @starsarenacom $2.9M hack indicates a reentrancy issue on the Stars Arena: Shares contract at https://t.co/Hg6C8MCPan
The reentrancy is abused to update the weight when the share/ticket is issued so that 1 share can be sold at a much higher price… https://t.co/17CxO3uLbe pic.twitter.com/fouVjevYTs
– PeckShield Inc. (@peckshield) October 7, 2023
Stars Arena later confirmed the attack on X, urging its users to stop depositing funds on its platform.
Even with an emptied smart contract, the project intends to go from strength to strength
This afternoon, Stars Arena communicated once again on X to reassure its users. According to the teams in charge of the project, the app will reopen shortly with “all funds in full” :
Important news: we have secured the resources to close the gap caused by the exploit.
Additionally, a special white hat development team is coming in to rapidly review the security of the platform.
We will re-open the contract with all the funds in full after a full security…
– Stars Arena (@starsarenacom) October 7, 2023
” Important news: we have secured the resources needed to close the gap caused by the exploit. In addition, a special team of white hat developers is arriving to quickly review the security of the platform. We will reopen the contract with all funds in full after a full security audit. This will happen very soon. See you on Spaces in a few hours. We’re not going anywhere. The Arena continues its march. “
Emin Gün Sirer, founder of Avalanche, came to the platform’s rescue on X, claiming that “Stars Arena is a profitable product” and that the amount stolen, almost $3 million, could be recovered “in about ten days” thanks to the app’s profitability.
Evolution of the total locked value (TVL) on Stars Arena
Just as we saw on the Ethereum blockchain for friend.tech at its peak, the excitement generated by the launch of Stars Arena momentarily caused a rise in transaction fees on Avalanche. This also led to a rise in the AVAX token price, although this has now fallen back. AVAX is trading at around $10.4 at the time of writing
