The Stars Arena has made a significant announcement, revealing that malevolent forces have been siphoning funds through a cunning loophole. However, the team has swiftly taken action, successfully patching the contract to avert any further harm.
As per reports circulating on social media, the Stars Arena Web3 social media platform on the Avalanche network has fallen victim to a malicious attack. This unsettling incident was brought to light by a Stars Arena user, Lilitch.eth, on October 5, who took to X (formerly Twitter) to declare that over $1 million had been lost as a result. The Stars Arena team has unequivocally acknowledged this audacious attack, characterizing it as nothing short of a “war” waged against their platform. Surprisingly, they assert that the actual losses incurred amount to a mere $2,000, affirming that they have successfully plugged the exploit.
Stars Arena, much like the popular Friend.tech, empowers users to acquire “shares” in the form of tokenized assets, which are generously distributed by content creators. These tokens confer upon their owners exclusive content access and other enticing benefits. Since the launch of Stars Arena, the Avalanche network has witnessed a remarkable surge in activity, with daily transactions skyrocketing by an astonishing 186% from October 3 to 4.
On October 5, Lilitch.eth made a sensational announcement on X, proclaiming, “A staggering $1.1 million is currently being siphoned away, courtesy of inexperienced developers who couldn’t replicate Friend.tech’s functionality successfully. If you happen to possess ANY SHARES in Stars Arena, it would be prudent to divest while the opportunity still exists.” Accompanying this statement was a screenshot of a smart contract, bearing an approximate value of 107,329 AVAX, equivalent to over $1 million at the time.
In response, some individuals accused Lilitch.eth of “fudding” – disseminating fear, uncertainty, and doubt. For instance, ZSwap developer Mork posited that “no exploiter could profit from this endeavor, given that the cost of gas for executing the transaction exceeded the extracted Avax” and further asserted that these were proxy contracts, susceptible to updates.
The Stars Arena team countered with a statement on X, emphatically declaring, “THE EXPLOIT HAS BEEN RECTIFIED.” They alleged that the attackers were expending $5 in gas fees to drain a mere $1 from the platform, evidently in a concerted effort to undermine its credibility through “coordinated FUD” (fear, uncertainty, and doubt). The team even conducted a Twitter Spaces event, aiming to elucidate the situation to their user base, confirming that the financial losses from the attack amounted to a paltry $2,000.
In response to the team’s statement, Lilitch.eth vehemently denied the claim that the attackers were spending $5 in gas fees to extract $1. They contended, “Nobody would spend $5 to obtain $1 from your TVL (Total Value Locked), relax,” asserting that the attackers ceased their actions whenever gas prices reached a point where the attack ceased to be profitable. Moreover, Lilitch.eth disavowed any notion of waging “war” against the platform. In a subsequent post, they extended an olive branch, expressing support for the app now that it had been fortified, declaring, “The conflict has been resolved, and we are now allies. @starsarena, to the moon!”
Meanwhile, Friend.tech users have found themselves grappling with a relentless wave of SIM-swap attacks, leaving both their community and that of similar applications on edge. On October 5, the Friend.tech team took proactive measures, implementing a function to remove certain login methods as part of their strategy to combat this ongoing issue.
