WHITE HAT PLAY BY PLAY: Following His $5.9 Million NFT Rescue On Friday, 0xQuit Broke Down What Happened And Warned That The Price Of Decentralization Is Eternal Vigilance!
1 hour ago
3 min read
After conducting a massive white hat rescue that saved nearly $6 million worth of NFTs on Friday, Yuga Labs’ Head of Blockchain gave the space a white hat play by play, explaining that the price of decentralization is eternal vigilance and that safety starts with each and every one of us!
On Monday, 0xQuit shared a 21 part tweet thread revealing how Limit Break’s now infamous Payment Processor contracts, which were used by marketplaces like Magic Eden and OSWiki, could be exploited to make the processor believe a victim’s wallet had authorized a trade it never actually approved.
“With `_msgSender, an attacker can make Payment Processor execute a trade as virtually any wallet with an outstanding approval,” 0xQuit wrote. “The attacker created an offer for a victim’s NFT at no cost, they then made the contract believe the victim was accepting that offer. his is why cancelling listings would not have helped. The attacker supplied the entire order. The only permission taken from the victim was their outstanding approval to Payment Processor.”
From there, 0xQuit said he reached out to the Limit Break team and worked with them to try to stop the Payment Processor. But they couldn’t.
“It could not be paused, so we looked at setting up reverting fee recipients, malformed forwarders, and anything else that could halt trading,” 0xQuit wrote. “We found no way to shut it off.”
That left 0xQuit with only one option, a white hat rescue.
“With the exploit already in the wild, we knew there was likely not much time before bigger drains began. I set off to scan for assets at risk and began assembling a list. With hundreds of thousands of events to comb through, this unfortunately was a large, slow task.”
From 1:46 A.M. ET on Friday until just after 5 A.M. ET, 0xQuit, with the help of fellow NFT enjoyers like Limit Break’s 0xJustADev, rescued more than 23,000 NFTs worth roughly $5.9 million USD.
Sadly, as 0xQuit worked to save the NFT space, others saw what he was doing onchain and began exploiting the Payment Processor themselves, leaving a number of wallets drained.
“At 6:13 AM my 4 year old daughter woke me up, and when I looked at my phone I saw pings alerting me that more apes had been drained,” 0xQuit recalled. “ 18 apes. My scanner had caught them while I was building out the ERC20 contract, but I never circled back to it after losing the race to save WETH. That will probably haunt me for the rest of my life.”
0xQuit went on to reveal that he is currently in contact with some of the bad actors who stole NFTs last week and is working to negotiate their return.
Tonight, 0xQuit thanked the NFT space for all of its support and donations while reminding everyone that bad actors will continue looking for ways to steal from collectors.
“Malevolent parties will continue to attack our space. Education is our best defense. For that I recommend @BoringSecurity and all of its contributors (including myself). Attackers will continue to get better. It's important that defense does too. hese donations enable me to devote a large amount of money on tokens to run intensive, persistent scans of important NFT infrastructure. Attackers are doing it, and so we must do it too. Our space is small and underrepresented, so it's up to us to make sure NFTs are safu.”
As the Gazette previsuly reported, a great place to start with wallet securutiy is revoking any and all approvals via Revoke.Cash.
If you were impacted by Friday’s exploit, be sure to check out 0xQuit’s NFTs Are Safu website to see whether he was able to save your J-Pegs: https://nftsaresafu.xyz
Comments