Ethereum

2024

Uniswap

Tornado

Zero

Vestra DAO appears to have been hacked. On-chain analysts noted suspicious activity where VSTR tokens, the protocol’s native ERC-20 token, were being moved from available smart contracts and immediately sent to the Tornado mixer.&nbsp; 
At least $480K worth of tokens had been stolen at the time of the reports. While the initial attack was relatively small, the risk remained for other participants. On-chain researcher Chaofan Shou first noted the exploit, advising all users to withdraw permissions.&nbsp; 
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"> 
 Vestra DAO <a href="https://twitter.com/Vestra_DAO?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">@Vestra_DAO</a> is hacked just now and still ongoing. $480K loss already and more to come. Withdraw your stake and pull liquidity immediately. <a href="https://t.co/0b9i1lhrEw" rel="nofollow" target="_blank">pic.twitter.com/0b9i1lhrEw</a> 
 — Chaofan Shou (@shoucccc) <a href="https://twitter.com/shoucccc/status/1864318918468489685?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">December 4, 2024</a>
</blockquote> 
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
The exploit has affected the VSTR token staking contract, with the funds immediately liquidated and sent to the Tornado mixer. For VSTR, more than 65% of the tokens are locked for governance, with over 34B tokens. 
The affected smart contract holds the remaining <a href="https://etherscan.io/token/0x92d5942f468447f1f21c2092580f15544923b434?a=0x8a30d684b1d3f8f36b36887a3deca0ef2a36a8e3" rel="nofollow noopener" target="_blank">755M</a> VSTR tokens, making up 1.51% of the total supply. Despite the attack against a relatively small token, the subsequent market crash erased even more value from the project. For now, Vestra DAO may have enough VSTR in its reserves to compensate users, while trying to repair its reputational damage. 
<h3 id="span-style-font-weight-400-exploiter-waited-for-a-month-before-exploiting-a-contract-logic-flaw-span">Exploiter waited for a month before exploiting a contract logic flaw</h3> 
The exploiter sold in a rush, paying 0.51 ETH to Beaverbuild for priority inclusion in a block. Vestra DAO’s locked <a href="https://etherscan.io/token/0x92d5942f468447f1f21c2092580f15544923b434?a=0x8a30d684b1d3f8f36b36887a3deca0ef2a36a8e3" rel="nofollow noopener" target="_blank">staking contract</a> was affected, directly sending out VSTR tokens.&nbsp; 
For hours, the exploiter sent out spam transactions for 520K or 500K VSTR to the contract, in the end, trading $480K in total. The attack exploited a logic flaw in the contract, which allowed the hacker to receive 20,000 VSTR after each transaction.&nbsp; 
On-chain analysis showed that the attacker first staked VSTR to the contract 30 days ago, lurking and studying the contract’s flaw. Then, the automated series of transactions started <a href="https://x.com/tonykebot/status/1864328661119475935" rel="nofollow" target="_blank">extracting VSTR</a> with each iteration of staking and unstaking. 
The data checks on every deposit and withdrawal did not trigger any warnings, allowing the attacker to drain the contract over multiple deposit and withdrawal transactions. The contract checked the maturity only once, but the hacker had completed the requirement by staking 30 days ago. 
The result of the exploit was a haul of 125 ETH, which was mixed through Tornado Cash. The attacker spent $40K on Ethereum gas for the fastest possible swaps, briefly becoming the biggest gas user on the chain.&nbsp; 
Vestra DAO has not issued the specifics of the attack and claimed user funds remained unaffected. However, the contract was drained of its VSTR tokens, clearly taking value from the project.&nbsp; 
<h3 id="span-style-font-weight-400-vstr-tokens-hacked-a-month-after-trading-launch-span">VSTR tokens hacked a month after trading launch</h3> 
Vestra DAO is a relatively new project, with VSTR tokens trading since November 6. The token is only available in a Uniswap V3 trading pair.&nbsp; 
The DAO ran its very first proposal on October 14, and it was tied to <a href="https://x.com/Vestra_DAO/status/1846237523682742533" rel="nofollow" target="_blank">selling</a> 1B tokens from the project’s treasury. The VSTR token still has only <a href="https://etherscan.io/token/0x92D5942f468447f1F21c2092580F15544923b434" rel="nofollow noopener" target="_blank">1,643</a> holders, adding to the limited effect of the hack.&nbsp; 
The token immediately <a href="https://www.coingecko.com/en/coins/vestra-dao" rel="nofollow noopener" target="_blank">crashed</a> after the attack, from $0.013 to $0.005. Later, VSTR inched up to $0.009 but remains extremely illiquid and volatile. In addition to the direct loss, VSTR also wiped out half its market capitalization. 
At this point, VSTR may be even riskier than early-stage meme tokens. The biggest risk is that VSTR tokens only have $1.9M in liquidity, which is not locked and can be further exploited via a rug pull.&nbsp; 
<figure id="attachment_622705" aria-describedby="caption-attachment-622705" style="width: 100%" class="wp-caption alignnone">
 <img loading="lazy" decoding="async" class="wp-image-622705 size-full" src="https://www.cryptopolitan.com/wp-content/uploads/2024/12/VestraDec42024.png" alt="Vestra DAO (VSTR) still relies on a Uniswap V3 pair, while its liquidity is unlocked and at risk for a rug pull." width="819" height="554" srcset="https://www.cryptopolitan.com/wp-content/uploads/2024/12/VestraDec42024.png 819w, https://www.cryptopolitan.com/wp-content/uploads/2024/12/VestraDec42024-300x203.png 300w, https://www.cryptopolitan.com/wp-content/uploads/2024/12/VestraDec42024-768x520.png 768w" sizes="(max-width: 819px) 100vw, 819px">
 <figcaption id="caption-attachment-622705" class="wp-caption-text">
 Vestra DAO (VSTR) still relies on a Uniswap V3 pair, while its liquidity is unlocked and at risk for a rug pull. | Source: <a href="https://dexscreener.com/ethereum/0x2349a69875aad7beb787f6f230ea2d71a52d6283" rel="nofollow noopener" target="_blank">DexScreener</a>
 </figcaption>
</figure> 
The other risk for the project is that its contracts invoke functions from external smart contracts, leading to a general <a href="https://www.coingecko.com/en/coins/vestra-dao" rel="nofollow noopener" target="_blank">warning</a> on CoinGecko. Vestra DAO claimed it had blacklisted its staking contract, but it is unknown if similar vulnerabilities exist for other smart contracts.&nbsp; 
Even for audited projects, smart contracts may not always be entirely secure and may hold exploit possibilities. In the case of the VestraDAO, the early-stage project may recover and boost its reliability.&nbsp; 
Vestra DAO appealed to the Turkish crypto community, one of the most active groups of early adopters. The VSTR token even had a conversion price into <a href="https://www.coingecko.com/en/coins/vestra-dao/try" rel="nofollow noopener" target="_blank">Turkish lira</a>. 
From Zero to Web3 Pro: Your 90-Day <a href="https://www.cryptopolitan.com/crypto-career-launchpad-waitlist/?utm_source=cryptopolitan&amp;utm_medium=banner&amp;utm_campaign=ccl-waitlist-3" target="_blank">Career Launch Plan</a>

Vestra DAO (VSTR) smart contract exploited less than a month after its launch

Table of Contents

Cryptopolitan_News

Other articles published on Dec 4, 2024

Whales Drive Demand for Pepe Coin

Can SUI Price Skyrocket to $4.70 Soon? Analyst Weighs In

Decoherence AI: Transforming Text into Dynamic Videos with Advanced AI Technology

Former Celsius CEO Alex Mashinsky Pleads Guilty to Fraud

HYPE Coin Surges Over 200% in Value

Celcius founder plead guilty due to fraud charges

Join our free newsletter for daily crypto updates!