<p>This is a referendumV2 whose proposer address (14jLVudzMk7udKvBUdFwPpgQnFKPpE4GxAYRJpEpokBgdmKq) is shown in on-chain info below. Only this user can edit this description and the title. If you own this account, login and tell us more about your proposal.</p>
<h1><strong>Abstract/TLDR</strong></h1>
<p>Following a significant hacking incident compromising Starlay Finance <a title="Starlay hacking incident" href="https://twitter.com/starlay_fi/status/1755605617421795560">https://twitter.com/starlay_fi/status/1755605617421795560</a>, we are urgently seeking support from the Polkadot community.&nbsp;</p>
<h1><strong>Details of the Request</strong></h1>
<p>The gravity of this situation and its potential repercussions on our users and the broader ecosystem necessitate your immediate support. We aim to explore viable measures to transfer all the DOT from the hacker's account to Starlay's account.</p>
<ul>
<li><strong>Amount at Risk:</strong> Approximately 200k DOT</li>
<li><strong>Concerned Hacker&rsquo;s Addresses on the Relay Chain:</strong></li>
</ul>
<ul>
<li>The hacker&rsquo;s addresses are colored in red in the account&nbsp; tab
<ul>
<li><a href="https://docs.google.com/spreadsheets/d/11Xko-3xY40qhF9rkPMYgrl35QAoT2aVkjsNsKYp15ns/edit?usp=sharing">https://docs.google.com/spreadsheets/d/11Xko-3xY40qhF9rkPMYgrl35QAoT2aVkjsNsKYp15ns/edit?usp=sharing</a></li>
</ul>
</li>
</ul>
<h1><strong>Situation: Hacking Details</strong></h1>
<p>The hack compromised all DOT and LDOT deposits within the Starlay protocol, with significant activities traced to the account <strong><code>0xe6F6D3cd38e9BF1e118C8Fd1528D303d261BA4F7</code></strong>. The exploitation centered around the Starlay interest-bearing USDC (lUSDC) address, which can be reviewed <a href="https://blockscout.acala.network/address/0x28A5AFACF605955e4c3aaF23b704C42Acd44EBb4/token-transfers#address-tabs">here</a>.</p>
<h2><strong>Incident Summary</strong></h2>
<p>The exploit was a result of anomalies within the USDC pool's liquidity index calculation, enabling the attacker to withdraw significantly more than their initial deposit after borrowing LDOT. This incident underscores a critical oversight in the pool's maintenance, particularly the failure to update the liquidity index due to prolonged inactivity.</p>
<h2><strong>Incident Description</strong></h2>
<p>The USDC pool remained devoid of funds for an extended period, approximately 20 to 25 days. This inactivity led to significant timestamp changes, resulting in an abnormally large newLiquidityIndex. The lToken (representative of a user&rsquo;s share in the pool) balance calculation, which relies on the normalizedIncome derived from the liquidityIndex, became distorted. Consequently, an attacker capitalized on this miscalculation by depositing into the pool, which triggered an unexpected increase in the liquidityIndex to 1,350,009,778 * 10^27. This inflated the attacker&rsquo;s lToken balance well beyond their actual deposit. The formula used was: balanceOfLToken = rayMul(realDeposit, liquidityIndex) = (realDeposit * liquidityIndex + 0.5 * 10^27) / 10^27. With a real deposit of 20,000,000 (with 6 decimals), the balanceOfLToken escalated to 27,000,195,560,000,000,000. This discrepancy allowed the attacker to withdraw USDC funds after borrowing LDOT (or DOT), despite the initial deposit being significantly lower.</p>
<h2><strong>Initial Setup and oversight:</strong></h2>
<p>At the launch of the Starlay protocol, three tokens were slated for listing: DOT, LDOT, and USDC. While DOT and LDOT were integrated through the Euphrates initiative, the USDC pool did not receive the necessary attention and remained unfunded. This neglect resulted in the liquidityIndex not being updated for an extended duration, setting the stage for the exploit.</p>
<p>&nbsp;</p>
<p><span style="font-family: S&ouml;hne, ui-sans-serif, system-ui, -apple-system, 'Segoe UI', Roboto, Ubuntu, Cantarell, 'Noto Sans', sans-serif, 'Helvetica Neue', Arial, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol', 'Noto Color Emoji'; font-size: 16px; white-space-collapse: preserve;">We welcome any assistance, advice, or support you can offer. Together, we can overcome this adversity and strengthen our ecosystem against future threats.Thank you for your attention and solidarity.</span></p>
<p></p>
<p></p>
<p></p>

- **Problem Statement:** Urgent support needed from the Polkadot community to address a significant hacking incident compromising Starlay Finance.
- **Significance:** Approximately 200k DOT at risk due to a hacking incident affecting all DOT and LDOT deposits within the Starlay protocol.
- **Proposed Solution:** Transfer all DOT from the hacker's account to Starlay's account to mitigate the impact of the hack.
- **Expected Outcomes:** Strengthening the ecosystem against future threats and ensuring the security of users and the broader community.

#546 Request for transferring all the DOT from the hacker's account to the Starlay's account