Stellar Expert uncovered a critical DEX matching engine vulnerability that allowed attackers to buy any asset at 1:1 rates via dust-sized trades. Attack potential reached 16,000 XLM per hour with 50 automated accounts. The vulnerability was responsibly disclosed to SDF and fixed in Stellar Core v10; all ecosystem funds remained secure.
Stellar Expert discovered a critical vulnerability in the Stellar DEX matching engine that allowed buying any asset at 1:1 rates via micro-trades, exploiting a rounding error during asset settlement. The attack potential was significant: with 50 accounts running automated traders, an attacker could earn up to 16,000 XLM per hour while causing major market disruption. The researcher discovered the vulnerability nine months before public disclosure, identified it during an investigation of suspicious price spikes on stellar.expert's aggregation platform. After responsibly disclosing via HackerOne, SDF developers confirmed the issue and deployed a fix in Stellar Core v10. When the exploit was spotted on the network, the upgrade was expedited and validators voted to activate protocol v10 within ten days. The matched exploit attempts ceased immediately. Today, the accounts involved are deleted; all ecosystem funds were secured throughout the incident.
