Full Report
Starstream is suite of products for revenue aggregation, generation and smart contract deployments. It exists on the Metis L2 rollup. The DistributorTreasury contract had a low-level call that took in arbitrary input. This allows an attacker to perform arbitrary function calls as the contract. To exploit this, they called withdrawTokens in the StarstreamTreasury to send to 532,571,155.859 $STARS to themselves. The treasury's owner was this contract, which gave it complete control to do whatever it wants. Arbitrary calls via a low-level call is very bad practice. Make sure to restrict this otherwise this type of attack will be possible.
Analysis Summary
# Incident Report: Starstream Treasury Arbitrary Call Exploit
## Executive Summary
Starstream, a revenue aggregation protocol on the Metis L2 rollup, suffered a significant exploit due to a vulnerability in its `DistributorTreasury` contract. An attacker leveraged an unrestricted low-level call to execute arbitrary functions, ultimately draining over 532 million $STARS tokens from the protocol's treasury. The incident highlights the critical risk of allowing user-supplied data in low-level contract interactions.
## Incident Details
- **Discovery Date:** Not explicitly disclosed in the report
- **Incident Date:** Not explicitly disclosed in the report
- **Affected Organization:** Starstream
- **Sector:** Decentralized Finance (DeFi) / Web3
- **Geography:** Global (Metis L2 Rollup)
## Timeline of Events
### Initial Access
- **Date/Time:** Undisclosed
- **Vector:** Exploitation of a vulnerable low-level call (`call`) in the `DistributorTreasury` smart contract.
- **Details:** The attacker identified that the `DistributorTreasury` contract accepted arbitrary input for a low-level call without sufficient validation or access control.
### Lateral Movement
- **Privilege Escalation:** Because the `DistributorTreasury` contract was set as the **owner** of the `StarstreamTreasury` contract, the attacker was able to act with the authority of the contract owner.
- **Interaction:** The attacker used the arbitrary call capability to invoke the `withdrawTokens` function within the `StarstreamTreasury` contract.
### Data Exfiltration/Impact
- **Asset Theft:** The attacker successfully transferred 532,571,155.859 $STARS tokens from the treasury to an attacker-controlled address.
### Detection & Response
- **Detection:** The incident was identified via on-chain monitoring of large-scale token movements from the Treasury.
- **Response actions taken:** General post-mortem analysis was conducted to identify the root cause (unrestricted low-level calls).
## Attack Methodology
- **Initial Access:** Exploitation of logic flaw in smart contract input validation.
- **Persistence:** Not applicable (Smart contract exploit).
- **Privilege Escalation:** Exploited the ownership relationship between two contracts to gain administrative rights.
- **Defense Evasion:** Not applicable.
- **Credential Access:** Not applicable.
- **Discovery:** Identified the `DistributorTreasury` as a proxy/controller for the main `StarstreamTreasury`.
- **Lateral Movement:** Inter-contract function calls via the Metis network.
- **Collection:** Targeting the $STARS token reserves.
- **Exfiltration:** Transfer of tokens to an external wallet.
- **Impact:** Significant financial loss and depletion of protocol reserves.
## Impact Assessment
- **Financial:** Loss of 532,571,155.859 $STARS tokens.
- **Data Breach:** None (Financial assets only).
- **Operational:** Disruption of revenue aggregation and distribution services.
- **Reputational:** High; loss of trust in the security of the Starstream suite and its smart contract deployments.
## Indicators of Compromise
- **Behavioral indicators:**
- Unexpected calls to `withdrawTokens` initiated by the `DistributorTreasury` contract.
- Large volume transfers of $STARS to a non-protocol address.
- Interaction with the `DistributorTreasury` involving complex, encoded data payloads designed for low-level `call` functions.
## Response Actions
- **Containment measures:** Analysis of the vulnerable contract to prevent further drains.
- **Eradication steps:** (Recommended) Implementation of a fix to the `DistributorTreasury` to restrict or remove arbitrary call functionality.
- **Recovery actions:** Community and developer outreach to assess the impact on the $STARS ecosystem.
## Lessons Learned
- **Key takeaways:** Granting a contract ownership over another contract creates a single point of failure; if the "owner" contract has a vulnerability, the "owned" contract is fully compromised.
- **What could have been done better:** The `DistributorTreasury` should never have been deployed with a function that allows unrestricted low-level calls (`.call()`) using arbitrary user-supplied data.
## Recommendations
- **Prevention measures:**
- **Avoid Arbitrary Calls:** Remove any functionality that allows users to pass arbitrary bytes into a `.call()` function.
- **Whitelisting:** If low-level calls are necessary, implement a strict whitelist of allowed target addresses and function signatures.
- **Security Audits:** Subject all treasury-controlling contracts to rigorous third-party audits focusing on access control logic.
- **Least Privilege:** Ensure that contracts acting as owners only have the specific permissions required for their task, rather than full administrative control.