October 18th, Stars Arena, an FT simulation platform based on the AVAX network, announced the final audit report of its contract on social media and stated that it will restart trading at any time within the next 24 hours.

The web3 social finance app based on Avalanche has been relaunched, but trading functionality is currently paused. The Stars Arena team announced that trading will only resume once a full audit has been published and the contract has been open-sourced for community review. The relaunch comes after the app was hacked on October 7, resulting in the loss of all funds locked in its smart contract. However, the platform managed to retrieve around 90% of the stolen funds after negotiating with the hacker responsible for the attack.

October 13th, Stars Arena tweeted that they are using recovered funds to make up for losses. The total amount of losses that need to be made up is 274,333 AVAX, and 239,493 AVAX have already been recovered. All expenses incurred so far will be added to the recovered funds, and the team will also obtain loans from private investors to make up the difference.

According to a recent announcement from the team on X , social media app Stars Arena has recovered around 90% of the funds it lost after being exploited. The recovery was achieved through four days of on-chain negotiations, as shown by blockchain data. The attacker was allowed to keep slightly more than 10% of the funds as a "white hat" bounty. The app was exploited on October 5, with the developers claiming that only around $2,000 worth of crypto was lost, while a user claimed over $1 million was lost. The exploited smart contract was upgradeable, and the team patched the exploit and relaunched with new code on the day of the attack.

Stars Arena has announced an update in an official tweet stating that it has recovered approximately 90% of the lost funds. We have reached an agreement with the person responsible for the recent security vulnerability. The funds have been returned in exchange for a 10% bounty fee + 1000AVAX lost in the cross-chain bridge. Total amount of lost funds: 266,104AVAX Amount returned: Two transactions of 119,246AVAX each, totaling 239,493AVAX Bounty: 26,610AVAX + 1000AVAX = 27,610AVAX

Chill Pill, a member of the Stars Arena team, stated during an AMA session that the platform is not yet ready to be relaunched and there is no exact time frame for its restoration, "perhaps in the next hour." He emphasized that the platform must be 100% secure and ensure that no one else will be harmed before it can be restarted, regardless of whether competitors are "ahead of us."

PeckShield's preliminary analysis shows that there is a reentrancy issue in the Stars Arena:Shares contract. Hackers exploit this vulnerability by abusing the update weight function during stock issuance, allowing a share to be sold at a higher price.In addition, there is a connection between the hacker's address and a phishing address starting with 0x85Ee. The funds for this address originally came from HTX.

SlowMist stated that the Stars Arena hacker has transferred 266,103 AVAX to the address (0xa2Eb...ad7A); on October 6, the address transferred 50.32 AVAX to FixedFloat.

PeckShield's initial analysis of the Stars Arena hack reveals that the Share contract on Stars Arena has a reentry vulnerability, which has been exploited to update the weight when issuing Shares/tickets, allowing 1 Share/ticket to be sold at a higher price (274,000 AVAX).

October 7th, according to data monitored by Paiduin, friend.tech's imitation game Stars Arena was stolen and lost about 2.9 million dollars.