Stars Arena Exploit

    how a fast-rising SoFi app on Avalanche got completely drained for nearly $3m in AVAX.

    Introduction

    Stars Arena is a fork (copycat) of the FriendTech SoFi (social finance) decentralized application that enabled users to make money with their network by trading tickets - access to posts and direct messages. The pricing of tickets followed a certain curve where prices increases exponentially to the number of buys and vice-versa. The dApp earned fees on each trade, and users earned ticket revenue and refferal fees. Stars Arena was launched in mid-September 2023 and had enjoyed a staggering rise in usage, however, the unfortunate thing happened when the app got hit by malicious actors in a space of 2 days - October 5, and October 7 respectfully. Now that the dust seems to have settled, let's take a look at the data metrics before the hacks, what happened during the hack, and how things stand now.

    Loading...
    Loading...
    Loading...
    Loading...

    We can see from the daily active users chart above, that the rise of Star Arena was astronomical. It took less than 20 days for the platform to reach the milestone of 10,000 active users in a day. It made >5k new users on 3rd and 4th October until the first exploit on October 5th, 2023.

    Exploits

    The first exploit, which happened on October 5, was not lethal in monetary terms. Allegedly, the attack was no economically viable. The drop in active users, volume, and total value locked all bounced back the next day. This meant that the exploit was quickly patched but this sent a message out, that there could be more vulnerabilities lurking.

    Lo-and-behold, Start Arena was exploited for the second time by the same exploiter on October 7, 2023, but this time, the contract that handled the trading of shares on the platform was completely drained with losses amounting to about $3m in AVAX tokens, completely crippling the platform and halting operations.

    Aftermath

    The skillset of Star Arena developers and the motivations of the malicious actors have all been questioned after the hack, but two things are clear. The hacker did not want a bounty and swiftly dispersed the funds after securing the loot. Secondly, Stars Arena will be coming back right after security audits and having successfully secured funding to close the $3m hole as mentioned in this announcement.

    To conclude, it is clear that socialized finance (SoFi) will be one of the major themes leading the forte for mass crypto adoption. However, due to the nascent nature of this niche market, it is imperative that developers, investors, and users do their due diligence before putting their funds into SoFi.