Smart Contract Bug attacks on Starknet

A legacy rebalancing contract that still held permissions on Troves' Starknet xWBTC vault was abused to drain roughly 8.6 BTC, about $0.7 million.

An attacker minted a worthless EVIL token to distort mySwap's concentrated-liquidity pool accounting on Starknet and drained about $305K of residual LP funds.

$9.5M drained from zkLend on Starknet via a precision-rounding bug in its safeMath library; repeated rounding inflated raw_balance until pools emptied.