{"id":568277,"date":"2022-03-03T14:29:12","date_gmt":"2022-03-03T11:29:12","guid":{"rendered":"https:\/\/en.ethereumworldnews.com\/?p=568277"},"modified":"2022-03-03T14:50:29","modified_gmt":"2022-03-03T11:50:29","slug":"treasure-dao-marketplace-exploited-100-nfts-stolen","status":"publish","type":"post","link":"https:\/\/en.ethereumworldnews.com\/treasure-dao-marketplace-exploited-100-nfts-stolen\/","title":{"rendered":"Treasure DAO Marketplace Exploited, 100+ NFTs Stolen"},"content":{"rendered":"<p>In brief:<\/p>\n<ul>\n<li>Treasure DAO has been exploited with hundreds of NFTs stolen<\/li>\n<li>The exploit was carried out through a series of transactions<\/li>\n<li>The hack was the result of a bug in distinguishing ERC721 and ERC1155 in &#8216;buyitem()&#8217;<\/li>\n<li>The team at Treasure DAO has apologized to those affected and frozen the marketplace<\/li>\n<li>Treasure DAO&#8217;s code is currently being reviewed and the team will propose remedial options for those affected<\/li>\n<\/ul>\n<p><a href=\"https:\/\/en.ethereumworldnews.com\/category\/news\/nft\/\" target=\"_blank\" rel=\"noopener\">The NFT industry<\/a> has suffered another major blow as Treasure DAO marketplace has been exploited and 100+ NFTs stole.<\/p>\n<p>After studying the exploit, the team at <a href=\"https:\/\/en.ethereumworldnews.com\/ethereum-address-that-paid-5m-in-eth-fees-belongs-to-a-ponzi-scheme\/\" target=\"_blank\" rel=\"noopener\">PeckShield<\/a> Inc. concluded that the hack was carried out in a series of transactions.<\/p>\n<p>According to their analysis which can be found in the tweet below, the hack was the result of &#8216;a bug in distinguishing ERC721 and ERC1155 in buyItem(), which mis-calculates the price of ERC721 as ERC1155 with the (untrusted) given 0 quantity.&#8217;<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">2\/ To illustrate, we use the above hack tx and show the key steps below: <br \/>1. Call buyItem() with valid NFT token and NFT ID, but w\/ invalid ZERO quantity<br \/>2. Treasure Marketplace sells the NFT but charges ZERO MAGIC (due to ZERO quantity) <a href=\"https:\/\/t.co\/OXGAHTtnZ2\" rel=\"nofollow\">pic.twitter.com\/OXGAHTtnZ2<\/a><\/p>\n<p>&mdash; PeckShield Inc. (@peckshield) <a href=\"https:\/\/twitter.com\/peckshield\/status\/1499251425393582081?ref_src=twsrc%5Etfw\" rel=\"nofollow noopener\">March 3, 2022<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<figure id=\"attachment_568282\" aria-describedby=\"caption-attachment-568282\" style=\"width: 1024px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/en.ethereumworldnews.com\/wp-content\/uploads\/2022\/03\/Peckshield-Treasure-DAO-hack-March-3rd.jpg\"><img class=\"size-large wp-image-568282\" src=\"https:\/\/en.ethereumworldnews.com\/wp-content\/uploads\/2022\/03\/Peckshield-Treasure-DAO-hack-March-3rd-1024x756.jpg\" alt=\"\" width=\"1024\" height=\"756\" srcset=\"https:\/\/en.ethereumworldnews.com\/wp-content\/uploads\/2022\/03\/Peckshield-Treasure-DAO-hack-March-3rd-1024x756.jpg 1024w, https:\/\/en.ethereumworldnews.com\/wp-content\/uploads\/2022\/03\/Peckshield-Treasure-DAO-hack-March-3rd-300x221.jpg 300w, https:\/\/en.ethereumworldnews.com\/wp-content\/uploads\/2022\/03\/Peckshield-Treasure-DAO-hack-March-3rd-770x568.jpg 770w, https:\/\/en.ethereumworldnews.com\/wp-content\/uploads\/2022\/03\/Peckshield-Treasure-DAO-hack-March-3rd-500x369.jpg 500w, https:\/\/en.ethereumworldnews.com\/wp-content\/uploads\/2022\/03\/Peckshield-Treasure-DAO-hack-March-3rd-269x199.jpg 269w, https:\/\/en.ethereumworldnews.com\/wp-content\/uploads\/2022\/03\/Peckshield-Treasure-DAO-hack-March-3rd-746x551.jpg 746w, https:\/\/en.ethereumworldnews.com\/wp-content\/uploads\/2022\/03\/Peckshield-Treasure-DAO-hack-March-3rd.jpg 1280w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" title=\"\"><\/a><figcaption id=\"caption-attachment-568282\" class=\"wp-caption-text\">Flowchart demonstrating the movement of NFTs. Source, @PeckShield<\/figcaption><\/figure>\n<h2>Treasure DAO Team Apologizes, Announces Course of Action<\/h2>\n<p>The team at Treasure DAO <a href=\"https:\/\/t.co\/P0sdzbOWE4\" target=\"_blank\" rel=\"nofollow noopener\">has since apologized<\/a> for the hack to the project&#8217;s community and provided a list of actions they plan on taking moving forward.<\/p>\n<p>To begin with, the team at Treasure DAO has identified and rectified the cause of the exploit. According to their analysis, the bug was the result of a previous fix that should have been identified earlier.<\/p>\n<p>Secondly, the current Treasure DAO marketplace will continue being frozen. No trades will be executed with current listings being safe.<\/p>\n<p>Thirdly, the team at Treasure DAO will do a thorough review of the code. Once the review is complete, the Treasure DAO marketplace will be redeployed with the fixes.<\/p>\n<p>Fourthly, a number of the NFTs affected by the hack have been rescued with the team requesting that they be sent to a Multisig address (0xDb6Ab450178bAbCf0e467c1F3B436050d907E233) in the next 24 hours.<\/p>\n<p>Lastly, a full list of stolen NFTs is being populated in a bid to assess the full impact of the exploit. Once complete, Treasure DAO &#8216;will propose a number of remediation options to ensure users are made whole&#8217;.\u00a0The Co-founder of Treasure DAO, John Patten, <a href=\"https:\/\/twitter.com\/jpatten__\/status\/1499184767480512512?s=21\" target=\"_blank\" rel=\"nofollow noopener\">has committed<\/a> to giving up all of his Smols to cater for the losses.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In brief: Treasure DAO has been exploited with hundreds of NFTs stolen The exploit was carried out through a series of transactions The hack was the result of a bug in distinguishing ERC721 and ERC1155 in &#8216;buyitem()&#8217; The team at Treasure DAO has apologized to those affected and frozen the marketplace Treasure DAO&#8217;s code is currently being reviewed and the team will propose remedial options for those affected The NFT industry has suffered another major blow as Treasure DAO marketplace [&hellip;]<\/p>\n","protected":false},"author":22,"featured_media":568289,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[108339],"tags":[108182,108184],"_links":{"self":[{"href":"https:\/\/en.ethereumworldnews.com\/wp-json\/wp\/v2\/posts\/568277"}],"collection":[{"href":"https:\/\/en.ethereumworldnews.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/en.ethereumworldnews.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/en.ethereumworldnews.com\/wp-json\/wp\/v2\/users\/22"}],"replies":[{"embeddable":true,"href":"https:\/\/en.ethereumworldnews.com\/wp-json\/wp\/v2\/comments?post=568277"}],"version-history":[{"count":0,"href":"https:\/\/en.ethereumworldnews.com\/wp-json\/wp\/v2\/posts\/568277\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/en.ethereumworldnews.com\/wp-json\/wp\/v2\/media\/568289"}],"wp:attachment":[{"href":"https:\/\/en.ethereumworldnews.com\/wp-json\/wp\/v2\/media?parent=568277"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/en.ethereumworldnews.com\/wp-json\/wp\/v2\/categories?post=568277"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/en.ethereumworldnews.com\/wp-json\/wp\/v2\/tags?post=568277"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}