2 years ago
In brief:
- Treasure DAO has been exploited with hundreds of NFTs stolen
- The exploit was carried retired done a bid of transactions
- The hack was the effect of a bug successful distinguishing ERC721 and ERC1155 successful ‘buyitem()’
- The squad astatine Treasure DAO has apologized to those affected and frozen the marketplace
- Treasure DAO’s codification is presently being reviewed and the squad volition suggest remedial options for those affected
The NFT industry has suffered different large stroke arsenic Treasure DAO marketplace has been exploited and 100+ NFTs stole.
After studying the exploit, the squad astatine PeckShield Inc. concluded that the hack was carried retired successful a bid of transactions.
According to their investigation which tin beryllium recovered successful the tweet below, the hack was the effect of ‘a bug successful distinguishing ERC721 and ERC1155 successful buyItem(), which mis-calculates the terms of ERC721 arsenic ERC1155 with the (untrusted) fixed 0 quantity.’
2/ To illustrate, we usage the supra hack tx and amusement the cardinal steps below:
1. Call buyItem() with valid NFT token and NFT ID, but w/ invalid ZERO quantity
2. Treasure Marketplace sells the NFT but charges ZERO MAGIC (due to ZERO quantity) pic.twitter.com/OXGAHTtnZ2
— PeckShield Inc. (@peckshield) March 3, 2022
Flowchart demonstrating the question of NFTs. Source, @PeckShieldTreasure DAO Team Apologizes, Announces Course of Action
The squad astatine Treasure DAO has since apologized for the hack to the project’s assemblage and provided a database of actions they program connected taking moving forward.
To statesman with, the squad astatine Treasure DAO has identified and rectified the origin of the exploit. According to their analysis, the bug was the effect of a erstwhile hole that should person been identified earlier.
Secondly, the existent Treasure DAO marketplace volition proceed being frozen. No trades volition beryllium executed with existent listings being safe.
Thirdly, the squad astatine Treasure DAO volition bash a thorough reappraisal of the code. Once the reappraisal is complete, the Treasure DAO marketplace volition beryllium redeployed with the fixes.
Fourthly, a fig of the NFTs affected by the hack person been rescued with the squad requesting that they beryllium sent to a Multisig code (0xDb6Ab450178bAbCf0e467c1F3B436050d907E233) successful the adjacent 24 hours.
Lastly, a afloat database of stolen NFTs is being populated successful a bid to measure the afloat interaction of the exploit. Once complete, Treasure DAO ‘will suggest a fig of remediation options to guarantee users are made whole’. The Co-founder of Treasure DAO, John Patten, has committed to giving up each of his Smols to cater for the losses.
English (US) 