Digital Asset
Intelligence
Security Incident · ETH Ecosystem

Startale Smart Contract Vulnerability: $2.88K Reported Loss

·Historical incident record

Incident Overview

Startale’s ERC-7579 smart accounts on Ethereum were exploited. The attacker abused a transient-storage initialization flag in initializeAccount that persists for the entire transaction, allowing re-initialization with a malicious bootstrap in the same tx after factory deployment. This enabled draining ~330 pre-funded counterfactual accounts (no signatures or capital required) for a total of ~$2,876. The Soneium network itself was unaffected.

Sources & References

Original incident referencehttps://x.com/exvulsec/status/2100111910524072258 (opens in a new tab)

This record presents information attributed to the linked sources. Incident dates describe the original event, not a new report. Reported loss figures reflect the source record and are not current market valuations.

More Security Incidents

View All →
  1. Incident date
    Target

    Nimiq

    Attack methodSmart Contract Vulnerability
    Reported loss$ 50,463
  2. Incident date
    Target

    Nostra

    Attack methodOracle Manipulation
    Reported loss$ 3,500,000
  3. Incident date
    Attack methodSmart Contract Vulnerability
    Reported loss$ 7,730,000
  4. Incident date
    Target

    Spiral

    Attack methodPrice Manipulation
    Reported loss$ 26,800
  5. Incident date
    Attack methodUnknown
    Reported loss$ 6,570,000