NFT Watchdog Group sees its NFT collection exploited

by James · September 3, 2022

Rug Pull Finder, an NFT watchdog group trying to prevent scams, hacks and scams in the non-fungible token space, has seen its own NFT project exploited.

The collection titled Bad Guys is based on bad actors who steal NFTs. But a flaw in the smart contract allowed two people to create 450 NFTs instead of the allowed one NFT per wallet.

Everyone – we are truly sorry

An exploit was shared with us 30 minutes before mint went live. After reviewing it with 3 different development teams, we did not believe the credibility of the information sent to us…

Obviously we were wrong and we are truly sorry https://t.co/ch0S7co8dA

— Rug Pull Finder (@rugpullfinder) 2 September 2022

Rye Pull Finder announced development itself, saying it was informed of the exploit 30 minutes before the coin went live, but they “didn’t believe in the credibility of the information sent to them.”

Meanwhile, community members mocked the group’s inability to prevent the exploit, with cryptosec expert OKHotshot pointing out that the 400 NFT coin was technically not a hack or exploit because the contract allowed it.

Today RugPullFinder’s nft contract was abused to mint 400 nfts instead of 1 per wallet

This is because the mint function lacks necessary checks. Safety checks, gas optimizations are also missing

Not a hack or technically an exploit – contract allowed it, but unethical nonetheless..

— OKHotshot (@NFTherder) 2 September 2022

Another community member took a shot at the group, saying “(with a) bio that says ‘Premiere source of information’ and ‘Researching NFT projects,’ it’s a bit confusing that they would launch a contract that could allow this to happen. “

Scott Mitchell asked why the team continued with the mint when it received a report of a possible exploit 30 minutes before going live.

An exploit was shared with us 30 minutes before mint went live — What was shared for the 3 teams?

It took 1 minute of looking at WhitelistMint and seeing if you ran a tx with “chosenAmount” for a large in a single tx outside of a web interface before that wallet worked.

— Scott Mitchell | sbmitchell.eth (@ScottMitchell18) 2 September 2022

Table of Contents

Rug Pull Finder to buy 366 NFTs for 2.5 ETH

Meanwhile, Rug Pull Finder seems to be finding solutions to the problem. An update shared on the situation confirmed that it has reached out to the wallets that took advantage of the exploit and offered 2.5 ETH to buy back the remaining 366 NFTs.

2/We have come to an agreement with the wallets that used the contract and agreed to pay them 2.5 ETH to buy the remaining 366 NFTs.

Although they may have found an advantage, this is not a hack or scammers, etc. They found a bug and they used it for profit.

— Rug Pull Finder (@rugpullfinder) 2 September 2022

It described the incident as not a hack or scam, as the wallets only saw an advantage in the flaw and decided to use it for profit.

That now plans to raffle all 330 NFTs it bought back from the wallet that was able to mint 400 NFTs in one transaction.

NFT thefts

While Rug Pull Finder says the exploitation of the NFTs was not a hack, research by Comparitech showed that malicious players have grabbed over $86 million worth of NFTs this year alone.

For Be[In]Crypto’s Latest Bitcoin (BTC) Analysis, click here.

Disclaimer

All information on our website is published in good faith and for general information purposes only. Any action the reader takes on the information contained on our website is strictly at their own risk.