In April 2022, the Starstream Finance and Agora DeFi projects were the victim of an attack. The attacker exploited vulnerabilities in Starstream to drain tokens from the protocol, which were then used as collateral to take out large loans from Agora.
Inside the Attack
The Starstream hack was made possible by an unprotected execute function in its DistributorTreasury contract. This function was labeled as external and could be used to call external functions.
The DistributorTreasury contract was made the owner of the StarstreamTreasury contract. Within this contract was a withdrawTokens function that could drain the contract’s reserves. While withdrawTokens was properly set to only be callable by the contract’s owner, this is the DistributorTreasury contract that contained the public execute function. The attacker used execute to call withdrawTokens, allowing them to steal funds from the contract.
These drained funds were then used as collateral to perform a borrow on the Agora platform. These borrowed funds were partially used to increase the value of STARS tokens, which increased the attacker’s collateral and allowed further borrows.
In total, the attacker borrowed approximately $8.2 million worth of tokens from Agora. These tokens were used for various purposes, such as being bridged off-chain, used to create STARS LP that were sent to Tethys lock addresses, and being sent to Starstream TreasuryDistributor.
Lessons Learned From the Attack
The Starstream and Agora hacker took advantage of relationships between various contracts as well as access control vulnerabilities. The insecure execute function in DistributorTreasury was used to exploit the StarstreamTreasury contract. Tokens stolen from Starstream were then used to attack Agora.
This hack demonstrates the complexity and risk associated with inter-contract relationships. Also, it underscores the importance of security audits as unprotected execute functions, such as the one in Distributor Treasury, should never exist in a smart contract.