Troves xWBTC Vault Stale-Permission Exploit

On October 31, 2026, Troves — a yield-strategy platform on Starknet — reported that its xWBTC/WBTC vault had been exploited for a preliminary loss of approximately 8.6 BTC, roughly $0.7 million. The root cause was a legacy rebalancing contract that had already been replaced but still retained active permissions over the vault.

What happened

Troves runs tokenized strategy "vaults" that automatically rebalance deposited assets; a dedicated rebalancing contract holds the privileges needed to move funds between positions on the protocol's behalf. According to Troves, when it upgraded that rebalancer, the outdated contract was never stripped of its permissions on the xWBTC/WBTC vault. The attacker abused those lingering, over-broad privileges to invoke the stale contract and drain roughly 8.6 BTC of wrapped bitcoin from the vault. The flaw was therefore an access-control / stale-authorization bug rather than a key compromise or a pricing exploit: the vault logic itself was sound, but a deprecated component retained the authority to move user funds. Troves said it detected the activity and, within about 40 minutes, revoked the problematic contract and removed all rebalancing permissions from its liquid-staking-token vaults.

Aftermath

As a precaution, Troves paused three vaults — xWBTC/WBTC, xSTRK/STRK and xstrkBTC/strkBTC — and said its other vaults showed no impact. The team sent an on-chain message to the attacker offering a 1 WBTC white-hat bounty in exchange for returning the remaining funds, and said security partners were tracing the stolen assets. Troves said it would publish a post-mortem and outline options for affected depositors once it had verified its findings. At the time of reporting no funds had been returned, no attacker identity or transaction hash had been published, and the 8.6 BTC figure remained a preliminary estimate that could be revised.

Why it matters

The incident is a textbook stale-permission failure: an upgrade shipped a new component but left the old one holding live privileges, turning a retired contract into an open door. It echoes other Starknet DeFi losses such as zkLend and Nostra, and reinforces a broader catalogue lesson — that privilege revocation is as important as code correctness. Rigorous audits of vault math do nothing if a deprecated address keeps the authority to move funds; every upgrade that rotates a privileged contract must explicitly revoke the predecessor's access as part of the same migration. The speed of Troves' response — revoking permissions within roughly 40 minutes — likely capped the damage well below what a slower reaction would have allowed.