Troves Protocol Suffers 8.6 BTC Exploit on Starknet Following Vault Breach

The Starknet-based decentralized finance (DeFi) protocol Troves confirmed a security breach on October 31, 2024, resulting in an initial loss of approximately 8.6 BTC. The exploit specifically targeted the platform's xWBTC/WBTC vault, raising concerns about legacy contract permissions within the ecosystem. While the attack was localized to a single pool, the project team has initiated emergency protocols to safeguard remaining assets and investigate the origin of the vulnerability.

Vulnerability in Legacy Rebalancing Contracts

The technical cause of the exploit was traced back to a deprecated version of a rebalancing contract. According to the Troves development team, although a newer version of the contract had been implemented, the older iteration retained active permissions over the vault's assets. This oversight allowed the attacker to interact with the protocol's liquidity and drain funds from the Wrapped Bitcoin (WBTC) pair.

In response to the incident, the protocol took the following immediate actions:

• The team revoked all permissions associated with the compromised and outdated contracts.
• Operations for affected and potentially exposed vaults, including xWBTC/WBTC, xSTRK/STRK, and xstrkBTC/strkBTC, were preventively suspended.
• Security auditors and internal developers began a comprehensive sweep of all Starknet-based smart contracts to ensure no other vaults were at risk.

Recovery Efforts and White Hat Negotiations

Troves is currently focused on fund recovery and has initiated communication with the exploiter. The protocol sent an on-chain message to the attacker's wallet address, proposing a 1 WBTC white hat bounty. In exchange for the bounty, the protocol has requested the immediate return of the remaining stolen funds. White hat bounties are a common practice in DeFi to incentivize the return of capital and the disclosure of vulnerabilities rather than pursuing legal action.

The team is continuing to investigate, trace funds, and explore recovery avenues. A detailed post-mortem report and a plan for affected depositors will be released later.

This incident highlights the ongoing risks associated with permission management in complex DeFi architectures, particularly when upgrading smart contracts on Layer 2 solutions like Starknet. The Troves team has committed to transparency and will provide a finalized reimbursement or recovery plan for users who held deposits in the xWBTC/WBTC vault at the time of the exploit. Owners of other assets within the protocol remain unaffected, as the breach did not extend beyond the identified rebalancing contract.