{"id":963,"date":"2022-01-26T01:41:09","date_gmt":"2022-01-26T08:41:09","guid":{"rendered":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/?p=963"},"modified":"2022-01-26T02:00:08","modified_gmt":"2022-01-26T09:00:08","slug":"how-a-bug-allowed-users-to-turn-1800-to-196000","status":"publish","type":"post","link":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/2022\/01\/26\/how-a-bug-allowed-users-to-turn-1800-to-196000\/","title":{"rendered":"How a bug allowed users to turn $1800 to $196,000"},"content":{"rendered":"\n
\"\"
OpenSea Logo, Source: https:\/\/docs.opensea.io\/docs\/logos<\/figcaption><\/figure><\/div>\n\n\n\n

On the early morning of January 24, 2022, the popular non-fungible token (or NFT) marketplace “OpenSea” was subject to the theft of over 1 million USD worth of NFTs[1]<\/sup>. Users of the platform were able to strategically exploit a design flaw within the website, which allowed them to purchase expensive NFTs for significantly lower than what they were listed for on the exchange. These same users then resold their newly purchased NFTs at a substantial profit. <\/p>\n\n\n\n

One user (by the username of TBALLER) reported on Twitter[2]<\/sup> that one of their Bored Ape NFT’s<\/a> was sold to one of the exploiters for 0.77 ETH (~$1800 USD at the time of the attack), which was quickly sold at a profit for 84.2 ETH (~$196,000 USD at the time of the attack) by the exploiter.<\/p>\n\n\n\n

\"\"
Transaction History of TBALLER’s Bored Ape NFT, Source: https:\/\/opensea.io\/assets\/0xbc4ca0eda7647a8ab7c2061c2e118a18a936f13d\/9991<\/figcaption><\/figure><\/div>\n\n\n\n

So what exactly happened?<\/h2>\n\n\n\n

Although the transactions of NFTs on OpenSea are recorded on the blockchain and cannot be tampered with, users were still able to purchase NFTs for the incorrect prices. So what gives?<\/p>\n\n\n\n

\"\"
How an NFT Transaction Works, Source: https:\/\/2muchcoffee.com\/blog\/how-to-build-an-opensea-like-nft-marketplace\/<\/figcaption><\/figure><\/div>\n\n\n\n

To start, OpenSea actually records transactions differently. Instead of waiting around for blockchain confirmations on the Ethereum network (which could take hours[2]<\/sup>), OpenSea settles the transactions directly on their website even if the transaction on the Ethereum network has not settled (this is often called as an “off-chain transaction). With that, when users on the marketplace list their NFTs and want to change the price to a substantially higher price, they would need to cancel the original listing and relist their NFT again. However, relisting their NFT requires a “gas fee”[3]<\/sup> which can be in the hundreds of dollars, because the old listing must be marked as cancelled on the blockchain. So to combat this, users circumvent the gas fee by transferring their NFT to an extra wallet and back to relist it. However, as mentioned before, the OpenSea website may recognize these new listings, but the old listings on the blockchain are still present because the gas fees were never paid.<\/p>\n\n\n\n

This inherent flaw of off-chain transactions is what users exploited. Despite the old transactions being cancelled on OpenSea, they were still active on the blockchain and can be accessed through the OpenSea API. Keen users were then able to use the OpenSea API to purchase numerous amounts of NFTs at extremely reduced prices because typically the old listings of the NFTs had lower prices than the new listings due to the exponential growth in value of NFTs within the past few months.<\/p>\n\n\n\n

\"\"
Growing Demand for NFTs, Source: https:\/\/www.reuters.com\/technology\/nft-sales-volume-surges-25-bln-2021-first-half-2021-07-05\/<\/figcaption><\/figure><\/div>\n\n\n\n

What can be learned from this?<\/h2>\n\n\n\n

After the incident has taken the public’s attention, OpenSea has issued a statement where it promises to reimburse those affected by the exploit[4]<\/sup>. This has been the only statement OpenSea has made regarding the exploit at this time. <\/p>\n\n\n\n

However, the exploit has been reported as early as January 1, 2022, which can be seen by the tweet below.<\/p>\n\n\n\n

\n

.@ACYCapital<\/a> purchased my @BoredApeYC<\/a> using the @opensea<\/a> hack that allows a prior listed ape to be sold even once it\u2019s been taken out of a wallet. I\u2019m pleading for this ape to be returned. I\u2019ll pay whatever fees were incurred.<\/p>— Carson\u1d4d\u1d50 \ud83c\udf4c\ud83d\udc3a (@carsonturner) January 1, 2022<\/a><\/blockquote><\/div>\n<\/div><\/figure>\n\n\n\n

It is currently unclear whether OpenSea was aware of such exploits or simply turned a blind eye towards its user base and their complaints regarding the exploits. With that, it is clear to see the importance of taking feedback from your customer base regarding severe issues such as vulnerabilities in your company’s system because one day, it may lead to millions of dollars in losses for your company.<\/p>\n\n\n\n

References<\/h3>\n\n\n\n

[1] https:\/\/www.bloomberg.com\/news\/articles\/2022-01-24\/how-traders-bought-1-million-in-nfts-at-massive-discount-due-to-an-opensea-bug<\/a><\/p>\n\n\n\n

[2] https:\/\/twitter.com\/T_BALLER6\/status\/1485523314621632514<\/a><\/p>\n\n\n\n

[3] https:\/\/etherscan.io\/gastracker<\/a><\/p>\n\n\n\n

[4] https:\/\/www.theverge.com\/2022\/1\/24\/22899125\/opensea-bug-bored-ape-nfts-smart-contract-listings-cancellation<\/a><\/p>\n\n\n\n

[5] https:\/\/www.theblockcrypto.com\/post\/131443\/opensea-reimburses-users-sold-nfts-below-market-value-ui-issue<\/a><\/p>\n\n\n\n

[6] https:\/\/www.bloomberg.com\/news\/articles\/2022-01-24\/how-traders-bought-1-million-in-nfts-at-massive-discount-due-to-an-opensea-bug<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

On the early morning of January 24, 2022, the popular non-fungible token (or NFT) marketplace “OpenSea” was subject to the theft of over 1 million USD worth of NFTs[1]. Users of the platform were able to strategically exploit a design flaw within the website, which allowed them to purchase expensive NFTs for significantly lower than … <\/p>\n

Continue reading “How a bug allowed users to turn $1800 to $196,000”<\/span><\/a><\/p>\n","protected":false},"author":352,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ngg_post_thumbnail":0,"footnotes":""},"categories":[15],"tags":[],"class_list":["post-963","post","type-post","status-publish","format-standard","hentry","category-cpsc-329-602-w22","entry"],"featured_image_src":null,"featured_image_src_square":null,"author_info":{"display_name":"Joshua Tolentino","author_link":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/author\/joshua-tolentino\/"},"_links":{"self":[{"href":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/wp-json\/wp\/v2\/posts\/963","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/wp-json\/wp\/v2\/users\/352"}],"replies":[{"embeddable":true,"href":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/wp-json\/wp\/v2\/comments?post=963"}],"version-history":[{"count":13,"href":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/wp-json\/wp\/v2\/posts\/963\/revisions"}],"predecessor-version":[{"id":990,"href":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/wp-json\/wp\/v2\/posts\/963\/revisions\/990"}],"wp:attachment":[{"href":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/wp-json\/wp\/v2\/media?parent=963"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/wp-json\/wp\/v2\/categories?post=963"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/wp-json\/wp\/v2\/tags?post=963"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}