Land of Genesis Mint Permission Hack - Revision history

Azoundria: Another 30 minutes complete. All sources merged in.

2023-05-24T20:44:59Z

Another 30 minutes complete. All sources merged in.

Azoundria: Initial 30 minutes completed.

2023-05-16T17:46:19Z

Initial 30 minutes completed.

← Older revision		Revision as of 11:46, 16 May 2023
Line 4:		Line 4:
	[[File:Landofgenesis.jpg\|thumb\|Land of Genesis NFT]]The Land of Genesis NFTs don't appear to have a widely known homepage. There are a maximum of 1,500 of them. An attacker appears to have minted a portion of NFTs that weren't supposed to be minted. Most funds remain in the attacker's wallet.		[[File:Landofgenesis.jpg\|thumb\|Land of Genesis NFT]]The Land of Genesis NFTs don't appear to have a widely known homepage. There are a maximum of 1,500 of them. An attacker appears to have minted a portion of NFTs that weren't supposed to be minted. Most funds remain in the attacker's wallet.

	This is a global/international case not involving a specific country.<ref name="slowmisthacked-2069" /><ref name="bscscan-10934" /><ref name="odailynews-10935~~" /><ref name="beosinalerttwitter-10936" /><ref name="foresightnews-10937" /><ref name="opensea-10938~~" /><ref name="bscscan-10939~~" /><ref name="dedotfisecuritytwitter-10940" /><ref name="nft-10941" /><ref name="bscscan-10942~~" />		This is a global/international case not involving a specific country.<ref name="slowmisthacked-2069" /><ref name="bscscan-10934" /><ref name="odailynews-10935" /><ref name="bscscan-10939" />

	== About Land of Genesis ==		== About Land of Genesis ==
			Information About: <ref name="opensea-10938" /><ref name="nft-10941" />

			Smart Contract: <ref name="bscscan-10942" />

	"Land of Genesis NFT is the ecological core andeconomic construction foundation of Miracle Farm,with a total of 1500 scarce resources.If you ownland NFT will get the entrance ticket of MiracleFarm ecology."		"Land of Genesis NFT is the ecological core andeconomic construction foundation of Miracle Farm,with a total of 1500 scarce resources.If you ownland NFT will get the entrance ticket of MiracleFarm ecology."

Line 65:		Line 69:
	\|-		\|-
	\|May 14th, 2023 10:39:50 AM MDT		\|May 14th, 2023 10:39:50 AM MDT
	\|Transaction		\|Malicious Minting Transaction
	\|~~Malicious~~ transaction.		\|The malicious minting transaction occurs on the Binance Smart Chain<ref>[https://bscscan.com/tx/0xe4db1550e3aa78a05e93bfd8fbe21b6eba5cce50dc06688949ab479ebed18048 Minting Attack Transaction - BSCScan] (May 16, 2023)</ref>. In this transaction, 200 NFTs are minted by the attacker exploiting the lack of validation<ref name="bscscan-10939" />.
			\|-
			\|May 15th, 2023 12:42:03 AM MDT
			\|Foresight News Report
			\|Foresight News reports on the incident (in Chinese)<ref name="foresightnews-10937" />.
	\|-		\|-
	\|May 15th, 2023 12:46:00 AM MDT		\|May 15th, 2023 12:46:00 AM MDT
	\|Beosin Alert		\|Beosin Alert on Twitter
	\|~~Alert~~ flagged.		\|An alert is flagged on Twitter by Beosin<ref>[https://twitter.com/BeosinAlert/status/1658000784943124480 BeosinAlert - "$land was exploited with a loss of 149,616 $BUSD" - Twitter] (May 16, 2023)</ref><ref name="beosinalerttwitter-10936" />.
			\|-
			\|May 15th, 2023 1:57:00 AM MDT
			\|DeDotFiSecurity Report
			\|A technical analysis is shared on DeDotFiSecurity Twitter<ref name="dedotfisecuritytwitter-10940" />.
	\|}		\|}

	== Technical Details ==		== Technical Details ==
	This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?		This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

			Smart Contract: <ref name="bscscan-10942" />

			=== DeDotFiSecurity Technical Analysis ===
			The DeDotFiSecurity Twitter posted a technical analysis explaining the exploit on Twitter<ref name="dedotfisecuritytwitter-10940" />.<blockquote>~$150,000 Exploit Alert

			Today, $LAND was exploited for 200 NFTs, caused by a lack of permission control on mint

			Here`s the on-chain flow of the attack

			1/ Exploit tx <nowiki>https://bscscan.com/tx/0xe4db1550e3aa78a05e93bfd8fbe21b6eba5cce50dc06688949ab479ebed18048</nowiki>

			Some of the miner addresses of the project can mint unlimited quantity of NFTs, including this wallet: 0x2e599883715d2f92468fa5ae3f9aab4e930e3ac7

			The scammer calls 0x2e599883715d2f92468fa5ae3f9aab4e930e3ac7 contract to mint 200 NFTs

			2/ Then, the scammer calls the 0x2c672a34 function of the 0xeab03ad7ea0ac5afb272b592bef88cf93ed190c5 contract to swap for a large amount of $XQJ using the previous minted NFTs (200 $XQJ per NFT)

			The attacker swaps 28,601 $XQJ for 149,616 $BUS

			3/ The scammer minted NFTs again until the NFT issue limit was reached</blockquote>

	== Total Amount Lost ==		== Total Amount Lost ==
Line 83:		Line 116:
	== Immediate Reactions ==		== Immediate Reactions ==
	How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?		How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

			<ref name="foresightnews-10937" />

	== Ultimate Outcome ==		== Ultimate Outcome ==
Line 112:		Line 147:

	== References ==		== References ==
	<references><ref name="slowmisthacked-2069">[https://hacked.slowmist.io/en/ SlowMist Hacked - SlowMist Zone] (Jun 26, 2021)</ref>		<references>
			<ref name="slowmisthacked-2069">[https://hacked.slowmist.io/en/ SlowMist Hacked - SlowMist Zone] (Jun 26, 2021)</ref>
	<ref name="bscscan-10934">[https://bscscan.com/address/0x2e599883715d2f92468fa5ae3f9aab4e930e3ac7 Contract Address 0x2e599883715d2f92468fa5ae3f9aab4e930e3ac7 \| BscScan] (May 15, 2023)</ref>		<ref name="bscscan-10934">[https://bscscan.com/address/0x2e599883715d2f92468fa5ae3f9aab4e930e3ac7 Contract Address 0x2e599883715d2f92468fa5ae3f9aab4e930e3ac7 \| BscScan] (May 15, 2023)</ref>

	<ref name="odailynews-10935">[https://www.odaily.news/newsflash/323329 安全公司：DeFi协议land疑似遭到攻击，损失约15万美元-快讯-ODAILY] (May 15, 2023)</ref>		<ref name="odailynews-10935">[https://www.odaily.news/newsflash/323329 安全公司：DeFi协议land疑似遭到攻击，损失约15万美元-快讯-ODAILY] (May 15, 2023)</ref>
			<ref name="beosinalerttwitter-10936">[https://twitter.com/BeosinAlert/status/1658002030953365505 BeosinAlert - "The attacker minted NFTs again until the NFT issue limit was reached." - Twitter] (May 15, 2023)</ref>
	<ref name="beosinalerttwitter-10936">[https://twitter.com/BeosinAlert/status/1658002030953365505 @BeosinAlert Twitter] (May 15, 2023)</ref>		<ref name="foresightnews-10937">[https://foresightnews.pro/news/detail/22953 Beosin: The DeFi protocol land is suspected of being attacked, and the loss is about 150,000 US dollars - Foresight News] (May 15, 2023)</ref>
			<ref name="opensea-10938">https://opensea.io/collection/land-11 (May 15, 2023)</ref>
	<ref name="foresightnews-10937">[https://foresightnews.pro/news/detail/22953 ~~Beosin：DeFi 协议~~ land ~~疑似遭到攻击，损失约 15 万美元~~ - Foresight News] (May 15, 2023)</ref>

	<ref name="opensea-10938">~~[https://opensea.io/collection/land-11~~ https://opensea.io/collection/land-11] (May 15, 2023)</ref>

	<ref name="bscscan-10939">[https://bscscan.com/tx/0x8c53c4d43e3fd869fea12c750cb81b487bebcb53ad63dcd0ec80e3661221f756 Binance Transaction Hash (Txhash) Details \| BscScan] (May 15, 2023)</ref>		<ref name="bscscan-10939">[https://bscscan.com/tx/0x8c53c4d43e3fd869fea12c750cb81b487bebcb53ad63dcd0ec80e3661221f756 Binance Transaction Hash (Txhash) Details \| BscScan] (May 15, 2023)</ref>
			<ref name="dedotfisecuritytwitter-10940">[https://twitter.com/DeDotFiSecurity/status/1658018770756009985 DeDotFiSecurity - "Today, $LAND was exploited for 200 NFTs, caused by a lack of permission control on mint" - Twitter] (May 15, 2023)</ref>
	<ref name="dedotfisecuritytwitter-10940">[https://twitter.com/DeDotFiSecurity/status/1658018770756009985 @DeDotFiSecurity Twitter] (May 15, 2023)</ref>

	<ref name="nft-10941">[https://nft.bitkeep.com/en/collection/bnb/0x1a62fe088f46561be92bb5f6e83266289b94c154 land Collections \| BitKeep NFT] (May 15, 2023)</ref>		<ref name="nft-10941">[https://nft.bitkeep.com/en/collection/bnb/0x1a62fe088f46561be92bb5f6e83266289b94c154 land Collections \| BitKeep NFT] (May 15, 2023)</ref>
			<ref name="bscscan-10942">[https://bscscan.com/token/0x1a62fe088f46561be92bb5f6e83266289b94c154 land (land) Token Tracker \| BscScan] (May 15, 2023)</ref>
	<ref name="bscscan-10942">[https://bscscan.com/token/0x1a62fe088f46561be92bb5f6e83266289b94c154 land (land) Token Tracker \| BscScan] (May 15, 2023)</ref></references>		</references>

Azoundria: Created page with "{{Imported Case Study 2|source=https://www.quadrigainitiative.com/casestudy/landofgenesismintpermissionhack.php}} {{Unattributed Sources}} Land of Genesis NFTThe Land of Genesis NFTs don't appear to have a widely known homepage. There are a maximum of 1,500 of them. An attacker appears to have minted a portion of NFTs that weren't supposed to be minted. Most funds remain in the attacker's wallet. This is a global/international case not..."

2023-05-16T17:14:10Z

Created page with "{{Imported Case Study 2|source=https://www.quadrigainitiative.com/casestudy/landofgenesismintpermissionhack.php}} {{Unattributed Sources}} thumb|Land of Genesis NFTThe Land of Genesis NFTs don't appear to have a widely known homepage. There are a maximum of 1,500 of them. An attacker appears to have minted a portion of NFTs that weren't supposed to be minted. Most funds remain in the attacker's wallet. This is a global/international case not..."

New page

{{Imported Case Study 2|source=https://www.quadrigainitiative.com/casestudy/landofgenesismintpermissionhack.php}}
{{Unattributed Sources}}

[[File:Landofgenesis.jpg|thumb|Land of Genesis NFT]]The Land of Genesis NFTs don't appear to have a widely known homepage. There are a maximum of 1,500 of them. An attacker appears to have minted a portion of NFTs that weren't supposed to be minted. Most funds remain in the attacker's wallet.

This is a global/international case not involving a specific country.<ref name="slowmisthacked-2069" /><ref name="bscscan-10934" /><ref name="odailynews-10935" /><ref name="beosinalerttwitter-10936" /><ref name="foresightnews-10937" /><ref name="opensea-10938" /><ref name="bscscan-10939" /><ref name="dedotfisecuritytwitter-10940" /><ref name="nft-10941" /><ref name="bscscan-10942" />

== About Land of Genesis ==
"Land of Genesis NFT is the ecological core andeconomic construction foundation of Miracle Farm,with a total of 1500 scarce resources.If you ownland NFT will get the entrance ticket of MiracleFarm ecology."

"Today, $LAND was exploited for 200 NFTs, caused by a lack of permission control on mint"

"The DeFi protocol land was suspected of being attacked and lost about 150,000 US dollars. The reason for the attack was the lack of mint permission control."

"Odaily Planet Daily News According to Beosin EagleEye’s security risk monitoring, early warning and interruption platform monitoring under the block chain security audit company Beosin, on May 14, Beijing time, DeFi Agreementland was suspected of being attacked, with a loss of approximately US$150,000. Beosin Trace traced and found that 149,616 BUSDs have been stolen."

"The reason for the attack was the lack of mint authority control. Specifically, there are several miner addresses at the （ project side mint NFT, including 0x2e59983715d2f92468fa5ae3f9aab4e930e3ac78; ）2（ attacker call 0x2e59，Use the NFT cast in the previous step to exchange a large amount of XQJ tokens （ for each NFT to 200 XQJ） until the contract cannot be replaced by XQJ; （4） The attacker exchanged 149,616 BUSDs;（5."

"Some of the miner addresses of the project can mint unlimited quantity of NFTs, including this wallet: 0x2e599883715d2f92468fa5ae3f9aab4e930e3ac7"

"The scammer calls 0x2e599883715d2f92468fa5ae3f9aab4e930e3ac7 contract to mint 200 NFTs"

"Then, the scammer calls the 0x2c672a34 function of the 0xeab03ad7ea0ac5afb272b592bef88cf93ed190c5 contract to swap for a large amount of $XQJ using the previous minted NFTs (200 $XQJ per NFT)

The attacker swaps 28,601 $XQJ for 149,616 $BUS"

"The scammer minted NFTs again until the NFT issue limit was reached"

"Most of the stolen funds are still at the attacker's address."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

* Known history of when and how the service was started.
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.

Don't Include:
* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - Land of Genesis Mint Permission Hack
!Date
!Event
!Description
|-
|May 14th, 2023 10:39:50 AM MDT
|Transaction
|Malicious transaction.
|-
|May 15th, 2023 12:46:00 AM MDT
|Beosin Alert
|Alert flagged.
|}

== Technical Details ==
This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

== Total Amount Lost ==
The total amount lost has been estimated at $150,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?
== General Prevention Policies ==
Multi-signature.
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="slowmisthacked-2069">[https://hacked.slowmist.io/en/ SlowMist Hacked - SlowMist Zone] (Jun 26, 2021)</ref>

<ref name="bscscan-10934">[https://bscscan.com/address/0x2e599883715d2f92468fa5ae3f9aab4e930e3ac7 Contract Address 0x2e599883715d2f92468fa5ae3f9aab4e930e3ac7 | BscScan] (May 15, 2023)</ref>

<ref name="odailynews-10935">[https://www.odaily.news/newsflash/323329 安全公司：DeFi协议land疑似遭到攻击，损失约15万美元-快讯-ODAILY] (May 15, 2023)</ref>

<ref name="beosinalerttwitter-10936">[https://twitter.com/BeosinAlert/status/1658002030953365505 @BeosinAlert Twitter] (May 15, 2023)</ref>

<ref name="foresightnews-10937">[https://foresightnews.pro/news/detail/22953 Beosin：DeFi 协议 land 疑似遭到攻击，损失约 15 万美元 - Foresight News] (May 15, 2023)</ref>

<ref name="opensea-10938">[https://opensea.io/collection/land-11 https://opensea.io/collection/land-11] (May 15, 2023)</ref>

<ref name="bscscan-10939">[https://bscscan.com/tx/0x8c53c4d43e3fd869fea12c750cb81b487bebcb53ad63dcd0ec80e3661221f756 Binance Transaction Hash (Txhash) Details | BscScan] (May 15, 2023)</ref>

<ref name="dedotfisecuritytwitter-10940">[https://twitter.com/DeDotFiSecurity/status/1658018770756009985 @DeDotFiSecurity Twitter] (May 15, 2023)</ref>

<ref name="nft-10941">[https://nft.bitkeep.com/en/collection/bnb/0x1a62fe088f46561be92bb5f6e83266289b94c154 land Collections | BitKeep NFT] (May 15, 2023)</ref>

<ref name="bscscan-10942">[https://bscscan.com/token/0x1a62fe088f46561be92bb5f6e83266289b94c154 land (land) Token Tracker | BscScan] (May 15, 2023)</ref></references>