VestraDAO Locked Staking User Still Marked Active

From Quadriga Initiative Cryptocurrency Hacks, Scams, and Frauds Repository
Revision as of 12:04, 22 January 2025 by Azoundria (talk | contribs) (Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/vestradaolockedstakinguserstillmarkedactive.php}} {{Unattributed Sources}} thumb|VestraDAO Logo/Homepage<ref name="vestradaotwitter-17425" /><ref name="cyversalertstwitter-17426" /><ref name="tenarmoralerttwitter-17427" /><ref name="vestradao-17428" /><ref name="vestradao-17429" /><ref name="etherscan-17430" /><ref name="vestradaotwitter-17431" /><ref name="vestra...")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to navigation Jump to search

Notice: This page is a freshly imported case study from an original repository. While the original content had a similar format, some sections may not have been fully completed. Please help fill in any empty sections or any missing information you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

VestraDAO Logo/Homepage

[1][2][3][4][5][6][7][8][9]

About VestraDAO

VestraDAO is a community-driven decentralized organization focused on transforming the finance industry by providing global financial solutions for brokers and investors. Its governance model empowers stakeholders to participate in decision-making processes through token-based voting. Community members can propose, discuss, and vote on key decisions, including electing new board members every three years and voting on proposals related to locked token usage. The governance structure ensures transparency and fairness, creating an inclusive environment where all members have a voice.

The platform emphasizes decentralized governance and transparent financial management through its community-managed treasury. VestraDAO offers a range of features, including Over-the-Counter (OTC) trading, staking rewards, and airdrops, while allowing users to buy VSTR tokens on Uniswap. Community members have the power to vote on partnerships and strategic collaborations, influencing the project’s direction. With a dynamic roadmap, VestraDAO is committed to long-term sustainability, focusing on DeFi solutions and Web3 products to drive financial innovation.

Built on the Ethereum blockchain, VestraDAO combines decentralized finance with blockchain technology, offering secure and accessible financial solutions. The Vestra token (VSTR), which adheres to ERC20 standards, powers the platform’s governance and ecosystem. At the heart of the project is the CMLE NFT Community, a passionate group of 502 members who govern the platform and drive its development. With the DAO mechanism in place, members can propose, vote, and earn passive income, contributing to the project's growth. VestraDAO’s first project, Brolyz, serves as a hub for community interaction, further solidifying the platform’s commitment to decentralization and innovation in the global financial landscape.

The Reality

The VestraDAO smart contract had a vulnerability in its locked staking contract. Specifically, the "unStake" function failed to properly check whether a user was marked as inactive after unstaking their tokens.

What Happened

A hacker exploited a vulnerability in the VestraDAO locked staking contract to claim 73,720,000 $VSTR tokens.

Key Event Timeline - VestraDAO Locked Staking User Still Marked Active
Date Event Description
December 4th, 2024 7:07:11 AM MST Malicious Transactions The malicious transaction reported by TenArmor.
December 4th, 2024 8:12:00 AM MST TenArmor Security Alert TenArmor reports a suspicious attack on VestraDAO, resulting in an estimated loss of $378,400. The attack exploited a flaw in VestraDAO's staking contract, specifically with the unStake function, which failed to properly check if a user was marked as inactive after unstaking. The attacker, who had staked 500,000 VSTR tokens a month ago, repeatedly called the unStake function to claim excessive VSTR tokens. The stolen funds have been deposited into Tornado Cash. The alert includes a transaction link for further details.
December 4th, 2024 8:27:00 AM MST CyversAlert Reports Situation CyversAlert reported that the VestraDAO project's locked staking contract was compromised, leading to a loss of approximately $480,000. The stolen $VSTR tokens were sold, and the funds were deposited into TornadoCash. The alert encourages users to secure their assets and offers a demo to help prevent future attacks.
December 5th, 2024 7:25:00 AM MST VestraDAO Team Announcement VestraDAO reports that a hacker exploited a vulnerability in the locked staking contract, stealing 73,720,000 VSTR tokens and causing a loss of approximately $500,000 worth of ETH liquidity. In response, they blacklisted the affected contracts, removing 755,631,188 VSTR from circulation and halting withdrawals. While users' funds are now inaccessible, VestraDAO assured the community they are working on a solution to reallocate the funds. Despite the incident, the team remains committed to building a sustainable project and believes the situation will stabilize soon.
December 5th, 2024 12:45:00 PM MST Join The Community VestraDAO pitches their community as a place to "[e]xplore vibrant discussions, share your insights, and connect with like-minded Vestrans."
December 6th, 2024 5:22:00 AM MST VestraDAO Tokens Isolated VestraDAO updates their community that 755,631,188 $VSTR tokens held within Locked Staking contracts have been permanently isolated and will never enter circulation. These tokens remain part of the total supply but are effectively removed from the ecosystem and cannot be accessed or used. VestraDAO emphasizes that this move ensures long-term stability for the tokenomics, with a reallocation plan for users’ remaining assets in these contracts to be announced soon. This step aligns with their goal of maintaining a balanced and transparent token economy, fostering growth and resilience within the community.
December 10th, 2024 7:12:00 AM MST VestraDAO Compensation Update VestraDAO updates their community, announcing that after a detailed meeting with CMLE NFT holders, they have decided to fully compensate users affected by the locked staking issue. Rather than proposing a payout via Governance, the decision was made to fund compensation directly through CMLE NFT holders. A total of 79.6 million VSTR, plus 4% staking rewards and 1% goodwill compensation, will be provided, amounting to 83.6 million VSTR in total. The compensation process will be completed by the end of December, with CMLE NFT holders managing the collection phase. No action is required from users at this time, and further instructions will be shared soon.

Technical Details

VestraDAO's smart contract contained a flaw in the "unStake" function of its locked staking contract. The function did not properly check if a user was marked as inactive after unstaking, allowing an attacker, who had staked 500,000 VSTR tokens a month prior, to repeatedly call the function. This enabled the attacker to claim more VSTR tokens than they were entitled to. The stolen tokens were then sold on Uniswap, resulting in significant financial losses.

"It appears the unStake function in VestraDAO's staking contract fails to properly check if a user is marked as inactive after unstaking.

An attacker, who staked 500k VSTR tokens a month ago, is now repeatedly calling the unStake function to claim an excessive amount of VSTR tokens."

Total Amount Lost

A hacker had exploited a vulnerability in the locked staking contract, manipulating the reward mechanism to claim excessive rewards. This led to the theft of 73,720,000 $VSTR tokens, which were then sold on Uniswap, resulting in the loss of approximately $500,000 worth of ETH liquidity.

TenArmor initially reported an estimated loss of approximately $378,400. CyversAlert later reported the total loss to be around $480,000.

The total amount lost has been estimated at $480,000 USD.

Immediate Reactions

VestraDAO initially reacted to the hack by swiftly identifying the issue and taking immediate action. VestraDAO blacklisted the locked staking contracts with the approval of 4 out of 7 delegates, disabling any further interactions with these contracts. Additionally, they removed 755,631,188 $VSTR tokens from circulation and reassured the community that they were working on a solution to reallocate the stolen funds to their rightful owners.

"Dear Vestrans,

Yesterday, we faced an unfortunate incident. A hacker exploited a vulnerability in the locked staking contract, manipulating the reward mechanism to claim excessive rewards beyond what they were entitled to. This led to a total of 73,720,000 $VSTR being stolen. The stolen amount was then gradually sold on Uniswap, resulting in the loss of approximately $500,000 worth of #ETH liquidity. However, we quickly identified the issue and took immediate action to blacklist the locked staking contracts with the approval of 4 out of 7 delegates, disabling any further interactions with the contracts. As a result, 755,631,188 $VSTR in the locked staking pools have been removed from circulation, and withdrawals can no longer be made from these contracts.

We acknowledge the impact of this situation on our community. Although users' funds in the locked staking pools are now inaccessible due to this measure, we want to assure you that we are fully committed to reallocating these funds to their rightful owners. The team is currently working diligently to finalize a solution and will share detailed plans in the coming days.

We are deeply grateful for the continued trust and support our community has shown during this process. Having such a strong, resilient, and united community is a great source of pride for us. We are determined to work together to overcome this challenge and deliver the best possible outcome for everyone involved.

While this unfortunate event has caused some price volatility, we are confident that the situation will stabilize soon and that its effects will be mitigated in the short term.

Our mission is to build a robust and sustainable project that will stand the test of time. We continue to work towards this goal with determination and resilience. By building our project on @ethereum, one of the most reliable blockchain networks in the world, we feel the strength of this foundation behind us.

Together, we can achieve stronger and more solid tomorrows.

Remember, as Vestrans, we are strong together, and together we will succeed."

Ultimate Outcome

The stolen $VSTR tokens were sold, and the funds were subsequently deposited into TornadoCash.

Total Amount Recovered

VestraDAO is providing compensation to affected users by offering 79.6 million VSTR tokens, which includes 4% staking rewards and an additional 1% goodwill compensation, bringing the total to 83.6 million VSTR. This compensation will be distributed to users with locked stakes for 3, 6, and 12 months. The distribution process was expected to be completed by the end of December 2024, and no action was required from users. CMLE NFT holders are responsible for managing the collection phase.

There do not appear to have been any funds recovered in this case.

Ongoing Developments

What parts of this case are still remaining to be concluded?

Individual Prevention Policies

No specific policies for individual prevention have yet been identified in this case.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Policies for platforms to take to prevent this situation have not yet been selected in this case.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

No specific regulatory policies have yet been identified in this case.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.

References

  1. ↑ @Vestra_DAO Twitter (Accessed Jan 21, 2025)
  2. ↑ @CyversAlerts Twitter (Accessed Jan 21, 2025)
  3. ↑ @TenArmorAlert Twitter (Accessed Jan 21, 2025)
  4. ↑ Reshaping the Finance with VestraDAO (Accessed Jan 21, 2025)
  5. ↑ Reshaping the Finance with VestraDAO (Accessed Jan 21, 2025)
  6. ↑ Ethereum Transaction Hash (Txhash) Details | Etherscan (Accessed Jan 22, 2025)
  7. ↑ @Vestra_DAO Twitter (Accessed Jan 22, 2025)
  8. ↑ @Vestra_DAO Twitter (Accessed Jan 22, 2025)
  9. ↑ @Vestra_DAO Twitter (Accessed Jan 22, 2025)
Retrieved from "https://quadrigainitiative.com/cryptocurrencyhackscamfraudwiki/index.php?title=VestraDAO_Locked_Staking_User_Still_Marked_Active&oldid=6456"