DeFi Protocol on Starknet Reports Vault Exploit

A DeFi protocol operating within the Starknet ecosystem, Troves, has publicly disclosed a security incident involving one of its asset vaults. The protocol's xWBTC/WBTC vault was exploited on October 31, leading to a financial loss.

Scope of the Attack and Initial Losses

The exploit was targeted specifically at the vault holding wrapped Bitcoin (xWBTC/WBTC) pairs. Preliminary estimates place the loss at approximately 8.6 Bitcoin. A key point for users is that the attack was contained to this single vault; other vaults within the protocol remain unaffected at this time.

This containment limits the overall impact, but underscores the persistent risks in decentralized finance structures.

Root Cause: Lingering Contract Permissions

Investigations point to a critical oversight in contract management as the primary cause. An old, outdated rebalancing contract that had been replaced in a previous protocol upgrade still retained administrative permissions.

Attackers exploited these residual permissions to execute unauthorized transactions on the vault. This incident highlights a recurring challenge in DeFi: the secure decommissioning of old contracts is as vital as building new ones.

Immediate Response from the Team

Upon discovering the breach, the project team implemented several emergency measures:

  • Permission Revocation: The outdated contract's access rights were immediately revoked to patch the vulnerability.
  • Preventive Vault Pauses: As a safety precaution, the team paused not only the compromised xWBTC/WBTC vault but also other vaults deemed potentially vulnerable, including xSTRK/STRK and xstrkBTC/strkBTC.
  • Ongoing Investigation: A full technical analysis is underway, alongside efforts to trace the movement of the stolen funds.

The Path Forward and White-Hat Outreach

Beyond technical fixes, the team is attempting to negotiate for the recovery of assets. A message has been sent on-chain to the exploiter's address, offering a "white-hat bounty."

The offer proposes a reward of 1 WBTC in exchange for the return of the remaining stolen funds. This is a common tactic in crypto security incidents, aiming to incentivize the attacker to act ethically and minimize losses.

Troves has committed to publishing a detailed post-mortem report in the future. Furthermore, they will outline a specific plan to address the situation for users who had deposits in the affected vault. The community is awaiting further updates as the investigation continues.