Treasure DAO has been exploited with hundreds of NFTs stolen
The exploit was carried out through a series of transactions
The hack was the result of a bug in distinguishing ERC721 and ERC1155 in ‘buyitem()’
The team at Treasure DAO has apologized to those affected and frozen the marketplace
Treasure DAO’s code is currently being reviewed and the team will propose remedial options for those affected
The NFT industry has suffered another major blow as Treasure DAO marketplace has been exploited and 100+ NFTs stole.
After studying the exploit, the team at PeckShield Inc. concluded that the hack was carried out in a series of transactions.
According to their analysis which can be found in the tweet below, the hack was the result of ‘a bug in distinguishing ERC721 and ERC1155 in buyItem(), which mis-calculates the price of ERC721 as ERC1155 with the (untrusted) given 0 quantity.’
2/ To illustrate, we use the above hack tx and show the key steps below: 1. Call buyItem() with valid NFT token and NFT ID, but w/ invalid ZERO quantity 2. Treasure Marketplace sells the NFT but charges ZERO MAGIC (due to ZERO quantity) pic.twitter.com/OXGAHTtnZ2
Treasure DAO Team Apologizes, Announces Course of Action
The team at Treasure DAO has since apologized for the hack to the project’s community and provided a list of actions they plan on taking moving forward.
To begin with, the team at Treasure DAO has identified and rectified the cause of the exploit. According to their analysis, the bug was the result of a previous fix that should have been identified earlier.
Secondly, the current Treasure DAO marketplace will continue being frozen. No trades will be executed with current listings being safe.
Thirdly, the team at Treasure DAO will do a thorough review of the code. Once the review is complete, the Treasure DAO marketplace will be redeployed with the fixes.
Fourthly, a number of the NFTs affected by the hack have been rescued with the team requesting that they be sent to a Multisig address (0xDb6Ab450178bAbCf0e467c1F3B436050d907E233) in the next 24 hours.
Lastly, a full list of stolen NFTs is being populated in a bid to assess the full impact of the exploit. Once complete, Treasure DAO ‘will propose a number of remediation options to ensure users are made whole’. The Co-founder of Treasure DAO, John Patten, has committed to giving up all of his Smols to cater for the losses.