Security Incident · Arbitrum Ecosystem
TreasureDAO Unchecked Input Data
The Arbitrum-based TreasureDAO NFT trading market was exposed and discovered a vulnerability.
- Attack category
- Unchecked Input Data
Incident Overview
According to SlowMist analysis, the core of this vulnerability lies in the lack of judgment that the incoming _quantity parameter is not 0 before the ERC-721 standard NFT transfer, resulting in ERC -721 Standard NFT can be transferred directly and the cost of purchasing NFT is calculated as 0 when calculating the price. Hours after it was stolen, developers confirmed that hackers had begun returning stolen “Smol Brains” and other NFTs.
Sources & References
This record presents information attributed to the linked sources. Incident dates describe the original event, not a new report. Reported loss figures reflect the source record and are not current market valuations.