MEEBITS

DESCRIPTION OF EVENTS

"Larva Labs, the OG NFT team behind CryptoPunks, released their new MeeBits project to major fanfare." "The Meebits are 20,000 unique 3D voxel characters, created by a custom generative algorithm, then registered on the Ethereum blockchain." "The NFT contract the governs ownership is a standard ERC-721 that works with any compatible service or exchange."

"If the Cryptopunks are an ideal 2D avatar for Discord, Twitter, and other social media, then we hope that the Meebits will be the 3D avatar for virtual worlds, games, and VR. We are bullish about the metaverse future, and we look forward to seeing how the Meebits are used in such environments."

"We also love low-poly and voxel 3D graphics. The style has been made popular in the last decade or so by games such as Minecraft and Roblox. We think that, just like 8-bit pixel art, the minimalism and accessibility of voxel art will prove timeless and endearing for generations to come."

"After gaining access to a zipped InterPlanetary File System (IPFS) file containing the ID and traits of each pre-minted MeeBit, Twitter user @0xNietzsche designed a contract to mint MeeBits over and over, but cancel the transaction if he didn’t receive a MeeBit with a desirable trait."

"It took 345 transactions, according to Etherescan. 0xNietzche estimated this cost him around $20k per hour in gas fees, but eventually he landed on an ultra-rare Alien “Visitor” MeeBit. He immediately sold the MeeBit on OpenSea for 200 ETH to the well-known NFT collector Pranksy (who didn’t know the MeeBit was a hack job)."

"Larva Labs has since paused MeeBits’ sale and trading functions to prevent further hacks of this sort, as one ultra-rare Dissected MeeBit remains unminted which could potentially become the prime target of a similar exploit before a fix is implemented."

"As for the exploited Visitor Meebit, which now has an enhanced lore throughout the MeeBits community, Pranksy immediately flipped it for 299 ETH."

The Meebits are collectible NFT characters, with potential rare attributes. Unfortunately, these attributes were generated using a not-so-random algorithm, which was predictable based on the hash of the present block.

A hacker was able to exploit this to obtain a rare Meebit that they then resold.

HOW COULD THIS HAVE BEEN PREVENTED?

In this particular case, the exploit was related to the random number generation, which could have been modified to use the hash of many blocks ahead, a value which could not be predicted.

This exploit is not really related to cryptocurrency exchange, nor did it result in a financial loss.

Check Our Framework For Safe Secure Exchange Platforms

$22 Million Was Stolen From Three Defi Platforms Last Weekend - The Defiant - DeFi News (May 23)
@sillytuna Twitter (May 24)
$85 million ‘Meebits’ NFT project exploited; attacker nabs $700,000 collectible  (May 24)
Ethereum Transactions Information | Etherscan (May 24)
Meebits’ $1.4M Sale Has Crypto Artists Calling Bubble - The Defiant - DeFi News (May 24)
@pranksyNFT Twitter (May 24)
Larva Labs Blog: Introducing the Meebits (May 27)
The Meebits (May 27)
Review on Next Million Dollar NFT - Meebits | NFT Marketplace Development (May 30)
Ultra-rare Meebit NFT minted via exploit sells for $765,000 | CryptoSlate (May 31)
Breaking: LarvaLabs’s Meetbit Collection Exploited to Mint $700,000 NFT Collectible | Headlines | News | CoinMarketCap (May 31)
Meebits Launched by Cryptopunks Studio Larva Labs (May 31)
Exploit in Larva Labs Meebits NFT Makes Rare Mints Printable at Will (Jun 26)
Meebit Nft Exploit Analysis (Aug 11)
blocksec-incidents/2021.md at main · openblocksec/blocksec-incidents · GitHub (Aug 11)

More case studies

Value DeFi
Fire Sale

Coinbase Deposit BSC
Wrapped Ethereum Spooky007x