TRICK OR TRAPPED: A TokenWorks Exploit Leaves 21 BAYC NFTs Stuck Inside The $APESTR Contract!

Do you want to play a game?

TokenWorks' $APESTR contract turned into a trap straight out of Saw this spooky season after an anonymous attacker exploited a known vulnerability to claim its Bored Apes' Mudwater packs, leaving 21 primates effectively trapped inside the contract and potentially putting hundreds of other NFTs at risk of a similar fate!

 

Things were anything but boring around the swamp Tuesday morning when an anonymous attacker exploited a reentrancy vulnerability in TokenWorks' $APESTR Strategy coin, swapping 21 Bored Apes held by the protocol for 21 other Apes in order to claim their Mudwater packs.

 

The exploiter dumped these Mudwater packs into bids earning about $14,000 from claiming and selling 210 Mudwater packs, but the exploit came with a frightening consequence, 21 Bored Apes were left trapped inside the Strategy coin's smart contract!

 

Yuga Labs' VP of Blockchain, 0xQuit, broke down the technical details of the exploit Tuesday. But simply put, the attacker tricked the $APESTR contract into accepting 21 Bored Apes without recognizing that it owns them. As a result, these primates cannot be listed or purchased through the protocol's flywheel, leaving each one individually swap out-able but 21 have to be stuck inside the contract going forward!

 

 

Following the attack, TokenWorks founder Rhynotic explained that the exploit effectively cleared the listing prices of the affected Apes, leaving them unlisted inside the contract. He also explained that the original Strategy contracts are not upgradeable, meaning the vulnerability cannot simply be fixed.

Worst of all, this trap doesn't end with Bored Apes!

According to Rhynotic, six other original Strategy coins contain the same vulnerability, potentially putting Pudgy Penguins, Meebits, Moonbirds, CryptoDickButts, Chromie Squiggles and CrypToadz by GREMPLIN at risk of a similar fate if someone decides to exploit their contracts for an airdrop or claim in the future.

 

“This was only profitable on the APESTR contract because of the Mudwater pack claim, but there's nothing stopping someone from being unprofitable and malicious to brick the other 6 (or if there is a profitable claim in the future),” he said. “NFTs getting locked in the contract is a horrible outcome. I'm glad that this didn't happen a year ago when there was more volume on these 7 tokens, but it's heartbreaking that the issue ended up being even worse.”

 

Tonight, these other six collection’s strategy coins’ respectively hold  59 Pudgy Penguins, 151 Meebits, 66 Moonbirds, 79 CryptoDickButts, 60 Chromie Squiggles and 222 CrypToadz, according to TokenWorks’ website.

 

After the exploit, avid NFT collector and CryptoPunk Mudtooth warned that the exploit could create a recurring opportunity for attackers to profit from future airdrops and rewards tied to NFTs held by the affected Strategy coins.

 

 

“Pudgy Penguins, Moonbirds, and especially Meebits will have a much bigger problem than Apes with this TokenWorks exploit in the future,” NFT Collector Mudtooth tweeted. “Every time these communities do an airdrop, this guy could claim and dump the rewards…. For him, it’s a forever passive income strategy. Every new airdrop becomes another payday. If TokenWorks can’t fix this, I believe the best solution is for these communities to airdrop directly to people’s wallets instead of requiring a claim, and blacklist the TokenWorks contract or other wallets holding large numbers of trapped NFTs from receiving the airdrop. Otherwise, this problem could keep coming back with every new airdrop.”

 

 

The Gazette will continue to follow this story and will keep you posted on any potential solutions and will let you know how projects face this going forward. Stay tuned for updates!