-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0295
============================================================

Advisory-ID:  0xCERT-2026-0295
Severity:     Medium
Published:    2026-10-31T08:25:21.000Z
Updated:      2026-11-01T07:13:32.053Z
Chains:       Other / Multi-chain
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0295

Title: Troves xWBTC/WBTC vault on Starknet drained of about 8.57 WBTC via legacy rebalancer that kept vault permissions

Summary
- -------
On 2026-10-31 an attacker drained about 8.57 WBTC-equivalent (about $667k) from Troves' Ekubo xWBTC/WBTC vault on Starknet through a retired rebalancing contract that still held vault permissions. Troves revoked the permissions and paused affected vaults.

Details
- -------
Summary
On 2026-10-31 (Starknet block 17,220,375, 08:25:21 UTC) Troves' Ekubo xWBTC/WBTC concentrated-liquidity vault on Starknet was exploited. Troves said a legacy rebalancing contract retained permissions over the vault after being replaced. Troves' first update put the loss at about 8.6 BTC; its on-chain message to the attacker states about 8.57 WBTC-equivalent. DefiLlama lists about $667k.

Affected
- - Troves (formerly STRKFarm) tEkubo xWBTC/WBTC vault on Starknet; Troves says no other vault was affected
- - Troves revoked the legacy contract's access about 40 minutes after discovery, removed rebalancing permissions from its LST vaults and paused the xWBTC/WBTC, xSTRK/STRK and xstrkBTC/strkBTC vaults

Impact
The attacker used a flash-loan-funded helper contract to invoke privileged rebalancing on the vault through the retired rebalancer and extract vault assets. Exploitation in the wild is confirmed. Troves offered a 1 WBTC whitehat bounty open until 2026-11-03 23:59 UTC and said a detailed post-mortem will follow.

Recommended actions
- - Do not deposit into paused Troves vaults until Troves confirms they are safe through official channels
- - Integrators and exchanges: flag the attacker account and helper contract below and monitor fund movements
- - Protocol teams: revoke all roles held by replaced contracts as part of every upgrade or migration

Source & attribution
This 0xCERT advisory summarises Troves' incident statement (https://x.com/trovesfi/status/2116541963755475375), the Troves on-chain message to the attacker reported by Defimon Alerts (https://x.com/DefimonAlerts/status/2116543245211587053), and an on-chain analysis by Panda Security: https://dev.to/pandasecurity/troves-exploit-a-retired-rebalancer-drained-857-wbtc-2009. Details may change; refer to the original source for the authoritative record.

References
- ----------
- - https://x.com/trovesfi/status/2116541963755475375
- - https://x.com/DefimonAlerts/status/2116543245211587053
- - https://dev.to/pandasecurity/troves-exploit-a-retired-rebalancer-drained-857-wbtc-2009
- - https://www.tokenpost.com/news/technology/45642
- - https://www.blockchainbreaches.com/en/breaches/troves-2026

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0FgmrofCIJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmfTqHeUfuone6DlZQ78am1wBImvEifEvYw2kNnD
xoRoaRYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAACyAwD+ND52aA0kYJHAximr
lD6FaQTnGtwQI2tH01x32P2jLUABANoAKQv1knf5vX8RAa5YPxlg5jVF56sN
yPX9x4hc+YYH
=czRK
-----END PGP SIGNATURE-----