Verify a decision

{"actor":"system:backfill","investigation_id":"e8f8bd4c-f2e4-4cec-8352-7c71d9fd1949","kind":"publish","page_slug":"stars-arena","published_at":"2026-05-31T07:00:15.955Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Stars Arena","sections":[{"content":"Stars Arena suffered two distinct exploits in rapid succession after launch. The first, on approximately October 5–6, 2023, involved a broken getPrice() function that allowed an attacker to transfer small amounts from the contract; the attack was economically inefficient because the gas cost exceeded the drained value, resulting in roughly $2,000 in losses. The team publicly declared the vulnerability fixed and migrated to a new, unverified smart contract. The second exploit followed within 24–48 hours on October 7, 2023 and was far more severe: a reentrancy vulnerability in the sellShares() function allowed an attacker to manipulate the share-price weighting variable (owner_a0) during a deposit callback, enabling the sale of shares at an artificially inflated rate of approximately 274,000 AVAX per share. The attacker drained 266,103 AVAX, valued at approximately $2.9–3 million at the time, dispersing the funds across 266 freshly created wallets. The new contract had not undergone any independent security audit prior to deployment. CertiK identified this as the fifth-largest reentrancy exploit of 2023.","heading":"October 2023 Smart Contract Exploits","severity":"critical","sources":[{"credibility":1,"name":"Avalanche Social App Stars Arena Drained of $3M in AVAX After Hack — CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2023/10/07/avalanche-social-app-stars-arena-drained-of-3m-in-avax-after-hack"},{"credibility":2,"name":"Stars Arena Incident Analysis — CertiK","type":"research","url":"https://www.certik.com/resources/blog/stars-arena-incident-analysis"},{"credibility":2,"name":"Explained: The Stars Arena Hack (October 2023) — Halborn","type":"research","url":"https://www.halborn.com/blog/post/explained-the-stars-arena-hack-october-2023"},{"credibility":2,"name":"Stars Arena Hack — Oct 7, 2023 — Detailed Analysis — ImmuneByes","type":"research","url":"https://immunebytes.com/blog/stars-arena-hack-oct-7-2023-detailed-analysis/"},{"credibility":2,"name":"Stars Arena — REKT","type":"news_article","url":"https://rekt.news/stars-arena-rekt/"}]},{"content":"Multiple indicators of inadequate security practices preceded the major exploit. The original smart contract was deployed without a public audit. After the first, smaller exploit on October 5–6, the team replaced the contract with another unaudited and unverified version. A pseudonymous security researcher, @0xlilitch, publicly flagged the first vulnerability on X; rather than treating this as a serious warning, the team framed community concern as 'coordinated FUD.' Ava Labs CEO Emin Gün Sirer characterized the first exploit as economically irrational and dismissed it, calling the loss of $2,000 'throwing money away.' Following the catastrophic second exploit, Sirer described the $3 million loss as 'a mere speed bump.' Security firm Rekt.news additionally identified that the platform had developer access to user private keys and was susceptible to DDoS attacks, the latter of which materialized after the second exploit and impeded the team's ability to communicate with users. The unverified replacement contract that was hacked for $2.9 million had been live for less than 24 hours.","heading":"Security Practices and Pre-Exploit Warning Signs","severity":"critical","sources":[{"credibility":2,"name":"SocialFi app Stars Arena dispels 'coordinated FUD' after patching 'noob' vulnerability — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/stars-arena-dispels-fud-patches-vulnerability"},{"credibility":2,"name":"Stars Arena — REKT","type":"news_article","url":"https://rekt.news/stars-arena-rekt/"},{"credibility":1,"name":"Stars Arena faces vulnerability that can potentially let users drain funds — The Block","type":"news_article","url":"https://www.theblock.co/post/254926/stars-arena-faces-vulnerability-that-can-potentially-let-users-drain-funds"},{"credibility":3,"name":"Security Vulnerability in AVAX-Based Stars Arena: Statement from Emin Gür Sirer — Bitcoin Sistemi","type":"news_article","url":"https://en.bitcoinsistemi.com/security-vulnerability-in-avax-based-stars-arena-statement-from-emin-gur-sirer/"}]},{"content":"Following the October 7 exploit, Stars Arena entered direct negotiations with the attacker. By October 11–12, 2023, the team announced it had reached an agreement: the exploiter agreed to return approximately 90% of the stolen funds in exchange for a bounty of 27,610 AVAX (approximately $257,000 at the time) plus an additional 1,000 AVAX in compensation. The exploiter signaled willingness to cooperate by signing an on-chain message from the attacker's address. Stars Arena separately announced it had secured outside funding to cover any shortfall before the relaunch, so that all user funds would be made whole. The recovery negotiations were conducted publicly via X.","heading":"Fund Recovery and Bounty Negotiation","severity":"high","sources":[{"credibility":1,"name":"Stars Arena Exploiter: 'I Want to Cooperate' — CoinDesk","type":"news_article","url":"https://www.coindesk.com/markets/2023/10/11/stars-arena-exploiter-i-want-to-cooperate"},{"credibility":1,"name":"Stars Arena Recovered 90% of the Funds Lost to Hack After Bounty Paid — CoinDesk","type":"news_article","url":"https://www.coindesk.com/markets/2023/10/11/stars-arena-exploiter-i-want-to-cooperate"},{"credibility":2,"name":"Stars Arena recovers 90% of stolen funds after offering $257K bounty — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/stars-arena-recovers-stolen-funds-after-offering-bounty-exploit"},{"credibility":2,"name":"Stars Arena secures funds to plug $3M exploit, set to reopen after security audit — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/stars-arena-secures-funds-to-plug-exploit"}]},{"content":"The original Stars Arena was developed and launched by a pseudonymous individual known publicly only as 'theBuilder' on X (Twitter). No verified real-world identity for the original developer has been publicly established. In November 2023, the platform was acquired by a new team following its near-collapse. The incoming team subsequently conducted a full contract rewrite and engaged Paladin — a security firm that has also worked with Ava Labs and LayerZero — for an independent audit before relaunching. The rebranded platform, The Arena (arena.social), is led by CEO Jason Desimone and COO Phillip Liu Jr, both named individuals, according to the official Avalanche blog. The $2 million pre-seed funding round closed in October 2024 with investors including Blizzard (the Avalanche Ecosystem Fund), Ava Labs and Avalanche leadership members, Balaji Srinivasan, Abstract Ventures, D1 Ventures, and others.","heading":"Team, Ownership, and Acquisition","severity":"medium","sources":[{"credibility":2,"name":"Exploring Stars Arena: A Guide to the Avalanche Social App — CoinGecko","type":"news_article","url":"https://www.coingecko.com/learn/stars-arena-avalanche-socialfi-crypto"},{"credibility":2,"name":"The Arena's Comeback: SocialFi App on Avalanche Secures $2M Pre-Seed Funding — Avax.network","type":"official","url":"https://www.avax.network/about/blog/the-arenas-comeback-socialfi-app-on-avalanche-secures-2m-pre-seed-funding-and-plans-mainstream-expansion"}]},{"content":"Stars Arena was widely described as a direct clone of Friend.tech, the Base-based SocialFi platform that popularized the model of tokenizing creator access through tradeable 'keys' or 'tickets.' Both platforms share a fundamental mechanism: users pay native cryptocurrency to purchase shares or tickets granting access to a creator's private channel, with price set by a bonding curve. Friend.tech itself faced criticism over rushed deployment, insider trading concerns, and regulatory uncertainty around the tokenized access model. Stars Arena replicated this architecture on Avalanche but did so without equivalent security diligence. The episode illustrated category-wide risks: SocialFi platforms often launch during hype cycles without audited contracts, hold significant TVL in unverified code, and attract users rapidly before any security review. The Block's subsequent research noted that The Arena's TVL eventually exceeded Friend.tech's, but the original exploit underscored that speed-to-market in SocialFi carries structural security risk. Rekt.news and other security commentators noted that reentrancy vulnerabilities of the type exploited in Stars Arena are well-documented and preventable through standard Checks-Effects-Interactions patterns.","heading":"SocialFi Category Risks and Comparison to Friend.tech","severity":"medium","sources":[{"credibility":1,"name":"FriendTech rival Stars Arena fuels Avalanche transaction surge — The Block","type":"news_article","url":"https://www.theblock.co/post/254788/friendtech-rival-stars-arena-fuels-avalanche-transaction-surge"},{"credibility":1,"name":"Research Unlock: Arena and The Future of SocialFi — The Block","type":"research","url":"https://www.theblock.co/post/362976/research-unlock-arena-and-the-future-of-socialfi"},{"credibility":3,"name":"What Is Stars Arena? Are Influencer 'SocialFi' Platforms Safe? — The Chainsaw","type":"news_article","url":"https://thechainsaw.com/finance/what-is-stars-arena-socialfi-safe/"}]},{"content":"After the acquisition in November 2023 and a Paladin security audit of the rewritten contract, the platform relaunched under the name The Arena at arena.social. By October 2024, the project had secured a $2 million pre-seed round and reported over 200,000 registered users. In May 2025, The Arena launched V2, incorporating a bonding-curve token launchpad and a native DEX. According to The Block's June 2025 research, the platform's DEX facilitated approximately $98 million in pre-bonding trade volume and $228 million in post-bonding trading volume since V2 launch. The Arena's ARENA token grew from a roughly $9.3 million market cap at the start of 2025 to a peak of approximately $55.5 million before declining to around $32 million by late June 2025. The platform's 30-day active wallet share on Avalanche reportedly reached 32% of all unique wallets at peak, making it one of the most-used consumer applications on the chain. The trajectory from the October 2023 exploit to V2 represents a substantial operational recovery, though the original incident remains a notable example of pre-audit deployment risk.","heading":"Relaunch as The Arena and Current Status","severity":"low","sources":[{"credibility":2,"name":"The Arena's Comeback: SocialFi App on Avalanche Secures $2M Pre-Seed Funding — Avax.network","type":"official","url":"https://www.avax.network/about/blog/the-arenas-comeback-socialfi-app-on-avalanche-secures-2m-pre-seed-funding-and-plans-mainstream-expansion"},{"credibility":1,"name":"Research Unlock: Arena and The Future of SocialFi — The Block","type":"research","url":"https://www.theblock.co/post/362976/research-unlock-arena-and-the-future-of-socialfi"},{"credibility":2,"name":"Web3 Social Platform Stars Arena Relaunches: Trading To Resume After Audit — CryptoNews","type":"news_article","url":"https://cryptonews.com/news/web3-social-platform-stars-arena-relaunches-trading-resume-after-audit/"}]}],"sources_used":[{"name":"Avalanche Social App Stars Arena Drained of $3M in AVAX After Hack — CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2023/10/07/avalanche-social-app-stars-arena-drained-of-3m-in-avax-after-hack"},{"name":"Stars Arena Exploiter: 'I Want to Cooperate' — CoinDesk","type":"news_article","url":"https://www.coindesk.com/markets/2023/10/11/stars-arena-exploiter-i-want-to-cooperate"},{"name":"Stars Arena drained of $2.9 million in AVAX tokens — The Block","type":"news_article","url":"https://www.theblock.co/post/255337/stars-arena-drained-of-2-9-million-in-avax-tokens-funds-in-user-wallets-are-safe"},{"name":"Stars Arena faces vulnerability that can potentially let users drain funds — The Block","type":"news_article","url":"https://www.theblock.co/post/254926/stars-arena-faces-vulnerability-that-can-potentially-let-users-drain-funds"},{"name":"Research Unlock: Arena and The Future of SocialFi — The Block","type":"research","url":"https://www.theblock.co/post/362976/research-unlock-arena-and-the-future-of-socialfi"},{"name":"Stars Arena Incident Analysis — CertiK","type":"research","url":"https://www.certik.com/resources/blog/stars-arena-incident-analysis"},{"name":"Explained: The Stars Arena Hack (October 2023) — Halborn","type":"research","url":"https://www.halborn.com/blog/post/explained-the-stars-arena-hack-october-2023"},{"name":"Stars Arena Hack — Oct 7, 2023 — Detailed Analysis — ImmuneByes","type":"research","url":"https://immunebytes.com/blog/stars-arena-hack-oct-7-2023-detailed-analysis/"},{"name":"Stars Arena — REKT","type":"news_article","url":"https://rekt.news/stars-arena-rekt/"},{"name":"SocialFi app Stars Arena dispels 'coordinated FUD' after patching 'noob' vulnerability — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/stars-arena-dispels-fud-patches-vulnerability"},{"name":"Stars Arena secures funds to plug $3M exploit, set to reopen after security audit — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/stars-arena-secures-funds-to-plug-exploit"},{"name":"Stars Arena recovers 90% of stolen funds after offering $257K bounty — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/stars-arena-recovers-stolen-funds-after-offering-bounty-exploit"},{"name":"Stars Arena secures funding to plug $3M shortfall — CryptoSlate","type":"news_article","url":"https://cryptoslate.com/stars-arena-secures-funding-to-plug-3m-shortfall-following-exploit-will-reopen-after-security-audit/"},{"name":"The Arena's Comeback: SocialFi App on Avalanche Secures $2M Pre-Seed Funding — Avax.network","type":"official","url":"https://www.avax.network/about/blog/the-arenas-comeback-socialfi-app-on-avalanche-secures-2m-pre-seed-funding-and-plans-mainstream-expansion"},{"name":"Web3 Social Platform Stars Arena Relaunches: Trading To Resume After Audit — CryptoNews","type":"news_article","url":"https://cryptonews.com/news/web3-social-platform-stars-arena-relaunches-trading-resume-after-audit/"},{"name":"Exploring Stars Arena: A Guide to the Avalanche Social App — CoinGecko","type":"news_article","url":"https://www.coingecko.com/learn/stars-arena-avalanche-socialfi-crypto"},{"name":"FriendTech rival Stars Arena fuels Avalanche transaction surge — The Block","type":"news_article","url":"https://www.theblock.co/post/254788/friendtech-rival-stars-arena-fuels-avalanche-transaction-surge"},{"name":"From Exploit to Recovery: Unpacking the Stars Arena Hack — Avascan / Medium","type":"research","url":"https://medium.com/avascan/from-exploit-to-recovery-unpacking-the-stars-arena-hack-07d8fb439367"},{"name":"Stars Arena Rebrands to The Arena — CoinLive","type":"news_article","url":"https://www.coinlive.com/news/stars-arena-rebrands-to-the-arena"}],"summary":"Stars Arena was an Avalanche-based SocialFi protocol launched on September 27, 2023, modeled closely on Friend.tech, allowing users to trade tokenized access to creators. Within ten days of launch the platform suffered two sequential smart contract exploits, with the second on October 7, 2023 draining approximately $2.9 million in AVAX through a reentrancy vulnerability — the entirety of its TVL. Following a partial fund recovery via bounty negotiation and a security audit, the platform was acquired by a new team in November 2023, rebranded as The Arena, and relaunched with a rebuilt contract.","timeline":[{"date":"2023-09-27","event":"Stars Arena launches on Avalanche, developed by pseudonymous 'theBuilder'. Platform modeled on Friend.tech, allowing trading of creator access tickets. TVL grows 3,400% to $1 million within the first week.","source":"CoinGecko / Altcoin Buzz","source_url":"https://www.coingecko.com/learn/stars-arena-avalanche-socialfi-crypto"},{"date":"2023-10-05","event":"First exploit: a broken getPrice() function allows an attacker to drain approximately $2,000 from the contract. The attack is economically inefficient, costing more in gas than it yields. Security researcher @0xlilitch publicly flags the vulnerability.","source":"The Block","source_url":"https://www.theblock.co/post/254926/stars-arena-faces-vulnerability-that-can-potentially-let-users-drain-funds"},{"date":"2023-10-05","event":"Ava Labs CEO Emin Gün Sirer publicly dismisses the vulnerability, characterizing the exploit as economically irrational and calling community concern 'FUD'. Stars Arena team calls it 'coordinated FUD' and deploys a new, unverified replacement contract.","source":"CoinTelegraph","source_url":"https://cointelegraph.com/news/stars-arena-dispels-fud-patches-vulnerability"},{"date":"2023-10-07","event":"Second exploit: A reentrancy vulnerability in the new contract's sellShares() function is exploited. The attacker manipulates a share-price weighting variable during a deposit callback, draining 266,103 AVAX (approximately $2.9 million), the entirety of the platform's TVL. Funds are dispersed across 266 wallets. A subsequent DDoS attack disrupts the team's communications.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2023/10/07/avalanche-social-app-stars-arena-drained-of-3m-in-avax-after-hack"},{"date":"2023-10-07","event":"Stars Arena suspends platform operations and posts a security notice advising users not to deposit funds. Smart contract attacker address identified as 0xa2Ebf3FCD757e9BE1E58B643b6B5077D11b4ad7A.","source":"CertiK Incident Analysis","source_url":"https://www.certik.com/resources/blog/stars-arena-incident-analysis"},{"date":"2023-10-11","event":"Stars Arena announces it has reached a bounty agreement with the exploiter. The attacker agrees to return approximately 90% of stolen funds in exchange for a 27,610 AVAX bounty (~$257,000) plus 1,000 AVAX. The exploiter signals cooperation via an on-chain signed message.","source":"CoinDesk","source_url":"https://www.coindesk.com/markets/2023/10/11/stars-arena-exploiter-i-want-to-cooperate"},{"date":"2023-10-12","event":"Stars Arena confirms recovery of approximately 90% of stolen funds and announces it has secured outside funding to cover the remaining shortfall, committing to make all users whole upon relaunch. Platform announces pending audit by Paladin before reopening.","source":"CryptoSlate","source_url":"https://cryptoslate.com/stars-arena-secures-funding-to-plug-3m-shortfall-following-exploit-will-reopen-after-security-audit/"},{"date":"2023-11-01","event":"Stars Arena is acquired by a new team following near-collapse of the original project. Original pseudonymous developer 'theBuilder' exits. Contract is fully rewritten and submitted for independent Paladin security audit.","source":"Avax.network official blog","source_url":"https://www.avax.network/about/blog/the-arenas-comeback-socialfi-app-on-avalanche-secures-2m-pre-seed-funding-and-plans-mainstream-expansion"},{"date":"2023-12-07","event":"Platform rebrands from Stars Arena to The Arena (arena.social) under new management.","source":"CoinLive","source_url":"https://www.coinlive.com/news/stars-arena-rebrands-to-the-arena"},{"date":"2024-10-01","event":"The Arena closes a $2 million pre-seed funding round with investors including Blizzard (Avalanche Ecosystem Fund), Ava Labs leadership, Balaji Srinivasan, Abstract Ventures, and D1 Ventures. Platform reports 200,000+ registered users.","source":"Avax.network official blog","source_url":"https://www.avax.network/about/blog/the-arenas-comeback-socialfi-app-on-avalanche-secures-2m-pre-seed-funding-and-plans-mainstream-expansion"},{"date":"2025-05-01","event":"The Arena launches V2, incorporating a bonding-curve token launchpad and native DEX. The DEX clears approximately $25 million in volume in its first week.","source":"The Block Research","source_url":"https://www.theblock.co/post/362976/research-unlock-arena-and-the-future-of-socialfi"}]},"v":1}