According to Coincu, the Avalanche-based Stars Arena project, a clone of friend.tech, is facing security concerns following a recent incident that has caused damage to many users' assets. In response, the project has announced a key migration to enhance security measures. The engineering team's investigation found no evidence linking the recent claims of funds draining to an exploit affecting the wider platform. Instead, the project believes that the affected Stars Arena incident is isolated and has identified the potential parties involved, who will be contacted directly.
On November 17, 2023, an account named "GiganticTip" shared on-chain data retrieval findings indicating that many users had their assets drained, with AVAX tokens being transferred through the FixedFloat mixer to obscure the hacker's identity. This time, the hacker only targeted AVAX tokens and did not sell tickets, unlike the first hack in early October 2023, which exploited a reentrancy vulnerability to sell tickets at inflated prices, causing Stars Arena's TVL to plummet. The attacker later returned the funds, keeping 10% as a bug bounty.
Despite the project's assurances and plans to continue development, the Stars Arena incident has further eroded users' trust. The incident raises questions about the project's security measures and the potential for further vulnerabilities. The upcoming key migration will be closely watched as the project seeks to regain user confidence and address ongoing security concerns.