# StarsArena: reentrancy in share purchase drains ~$3M

Reentrancy in StarsArena share-buying on Avalanche let attacker re-enter during AVAX receive callback to mint/sell shares, netting ~$3M.

- Payout: Real-world hack
- Severity: high
- Program: StarsArena
- Analysis by: DeFiHackLabs
- Disclosed: 2023-10-07
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-10/StarsArena_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20231007-starsarena
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:reentrancy

**Target:** StarsArena share market contract on Avalanche
**Root cause:** The buy function forwards AVAX to the caller before finalizing share accounting, allowing the attacker's receive() to re-enter a share-purchase function and manipulate share state.
**Steps:**
1. Attacker contract calls victim `0xe9ccf3a3` with `(address(this), true, address(this))` sending 1 AVAX.
2. Victim sends AVAX back, triggering attacker `receive()`.
3. In `receive()`, attacker re-enters victim with selector `0x5632b2e4` and args `(91e9, 91e9, 91e9, 91e9)`.
4. After reentry, attacker calls `sellShares(address(this), 1)` to extract funds.
**How found:** DeFiHackLabs reproduced the on-chain attack; the attacker likely spotted that the buy path performed an external AVAX transfer before updating share balances, enabling reentrancy.
**Exploitation:** Attacker deployed a contract, called the buy function with 1 AVAX, and during the ETH/AVAX receive callback re-entered the share-purchase function with large arguments, then sold shares to drain ~$3M from the victim contract.
**Insight:** On EVM share/AMM contracts, check whether native-token refunds or payouts occur before state finalization; a receive() hook is enough to re-enter mint/buy logic and skew share pricing.