NFTX

DESCRIPTION OF EVENTS

"Buy, sell, and swap NFTs instantly. Stake and earn yield on the most liquid decentralized NFT marketplace." "NFTX is a platform for creating liquid markets for illiquid Non-Fungible Tokens (NFTs)."

"Users deposit their NFT into an NFTX vault and mint a fungible ERC20 token (vToken) that represents a claim on a random asset from within the vault. vTokens can also be used to redeem a specific NFT from a vault."

"On June 29, 2021 NFTX asset validation error was exploited which resulted in the theft of 2 CryptoPunk NFTs. Stolen NFTs were eventually bought back for 6 ETH ($12K)."

"With our new NFTX v2 launch, we have decided to perform a gradual migration of the DAO treasury liquidity provided to PUNK/NFTX. In order to practice caution, we announced that the migration will be gradual and over time, starting with ~10% of the liquidity provided by the DAO."

"To begin the migration, custody of the liquidity was handed off to Alex for a simpler migration. Alex approved 2 CryptoPunks for transfer to the vault contract, and immediately after sent the mint transaction to the vault to receive his PUNK tokens. However, this transaction was frontrun and ended up failing, with his 2 PUNK vault tokens going to the frontrunners address. Shortly after noticing something was off, the team's guardian permissions were used to pause all vault functions in order to give us time to investigate."

"After the attacker noticed our pause, they quickly sold the 2 PUNK tokens on the (illiquid) Sushiswap PUNK/NFTX pool, and made off with ~6 ETH. Soon after they were sold, we purchased back the 2 PUNK tokens for ~6 ETH, returning the tokens back to our custody. We have also staged an upgrade to solve the attack vector (detailed below), and will unpause the contracts after the upgrade is deployed."

"We did have a very successful audit with Code 423n4, however, the unique logic to handle these NFTs was added after the audit was complete, since we made the decision to handle bare CryptoPunks rather than Wrapped Punks later after the audit. We did go through an independent audit after our changes from Code 423n4, but it appears this flaw was missed due to the CryptoPunks contract not being within scope of the audit."

"We purchased back 2 PUNK (6 ETH worth at the time) of PUNK, retrieving back custody of the original stolen assets."

NFTX is a NFT trading platform. During a contract upgrade, a transaction involving two NFTs was frontrun and the NFTs were taken. The tokens needed to be repurchased for 6 ETH. It's unclear if this affected any users of the platform.

https://www.blockthreat.io/p/blockthreat-week-26-2021 (Feb 8)
Buy, Sell, and Swap NFTs Instantly - NFTX App (Feb 16)
Introduction to NFTX - NFTX (Feb 17)
NFTX v2 PUNK Incident Post Mortem (Feb 17)
https://coinmarketcap.com/currencies/ethereum/historical-data/ (Dec 21)
NFTX v2 PUNK Incident Post Mortem (Feb 19)

More case studies

ThorChain ETH
Bifrost Exploit

DDEX XDX Swap
Backdoor