Azoundria: Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/zorabasesettlerbasesettlermetatxnmistakenlyclaimable.php}} {{Unattributed Sources}} Zora Network Logo/HomepageZora, an onchain social network aimed at empowering creators through decentralized tools and the $ZORA token, suffered a smart contract vulnerability due to human error. The team mistakenly set claimable tokens for contracts that could execute arbi..."

2025-08-27T21:37:09Z

Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/zorabasesettlerbasesettlermetatxnmistakenlyclaimable.php}} {{Unattributed Sources}} thumb|Zora Network Logo/HomepageZora, an onchain social network aimed at empowering creators through decentralized tools and the $ZORA token, suffered a smart contract vulnerability due to human error. The team mistakenly set claimable tokens for contracts that could execute arbi..."

New page

{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/zorabasesettlerbasesettlermetatxnmistakenlyclaimable.php}}
{{Unattributed Sources}}

[[File:Zoranetwork.jpg|thumb|Zora Network Logo/Homepage]]Zora, an onchain social network aimed at empowering creators through decentralized tools and the $ZORA token, suffered a smart contract vulnerability due to human error. The team mistakenly set claimable tokens for contracts that could execute arbitrary calls, which an attacker exploited to drain approximately $140.8K in tokens. Despite the breach, Zora has made no public acknowledgment of the error on their Twitter/X, and there is no indication of recovered funds or an ongoing investigation, potentially leaving the situation unresolved, unexplained, and any affected users in the dark.<ref name="tenarmortweet-20907" /><ref name="latestattack-20908" /><ref name="setallocations-20909" /><ref name="attacktransaction-20910" /><ref name="zoratwitterx-20911" /><ref name="zorahomepage-20912" /><ref name="zoraaboutpage-20913" /><ref name="basetweet-20914" /><ref name="blogmexc-20915" />

== About Zora Network ==
Zora is an onchain social network that reimagines how people create, connect, and earn online using blockchain technology. At its core, Zora provides a platform where users can share content—from art to photography to thoughts and ideas—while leveraging the transparency and ownership offered by crypto. This system enables a new type of digital interaction where creators can directly monetize their work and build communities without relying on traditional intermediaries.

The platform supports a wide range of creative expression, from generated visuals and photography to written reflections on crypto and internet culture. Zora promotes a more equitable digital economy by enabling creators and collectors to participate in secondary markets onchain. Its acquisition of Mint Fun and launch of the \$ZORA token further emphasize its commitment to building a decentralized and user-first ecosystem.

Zora is driven by a vision to "build pure internet"—a borderless, internet-native space for collaboration and creation. With a globally distributed team and no centralized headquarters, Zora embodies the principles of web3 decentralization. Through its tools, writing, and community, it aims to empower individuals to rediscover the internet’s potential and shift power back into the hands of creators.

== The Reality ==
Unfortunately, even the best smart contract can still allow for some degree of human error.

== What Happened ==
Zora, a decentralized social network, suffered a $140.8K exploit due to a smart contract misconfiguration.
{| class="wikitable"
|+Key Event Timeline - Zora BaseSettler BaseSettlerMetaTxn Mistakenly Claimable
!Date
!Event
!Description
|-
|April 22nd, 2025 11:40:11 PM MDT
|The Latest Attack Transaction
|The transaction which TenArmor refers to as "[t]he latest attack t[ransaction]".
|-
|April 24th, 2025 7:32:03 AM MDT
|BaseSettler Contract Allocations
|The transaction which TenArmor refers to as "setAllocations for the BaseSettler contract".
|-
|April 24th, 2025 10:24:57 PM MDT
|Attack Transaction
|The transaction which TenArmor refers to as simply an "[a]ttack transaction".
|-
|April 25th, 2025 12:09:00 AM MDT
|TenArmor Tweet Posted
|TenArmor makes a post about the incident, reporting the total loss, the mechanism behind it, and multiple related transactions.
|}

== Technical Details ==
"The root cause is that the Zora team mistakenly set claimable tokens for the BaseSettler and BaseSettlerMetaTxn contracts via the setAllocationsWithSignature function of the ZoraTokenCommunityClaim contract.

However, these settler contracts can be leveraged to execute arbitrary calls.

The attacker crafted calls to the BaseSettler contract and executed the claim function of the ZoraTokenCommunityClaim contract, ultimately obtaining Zora tokens."

== Total Amount Lost ==
Losses were reported as $140.8K by TenArmor.

The total amount lost has been estimated at $141,000 USD.

== Immediate Reactions ==
There doesn't appear to be any mention of the situation on Zora's public Twitter/X.

== Ultimate Outcome ==
Nothing about this case has ever appeared on the Zora's Twitter/X. It is unclear if they have done anything to anyone who may have been affected.

== Total Amount Recovered ==
There is no indication that any funds have been recovered.

There do not appear to have been any funds recovered in this case.

== Ongoing Developments ==
It is unclear if there is any further investigation ongoing.
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="tenarmortweet-20907">[https://twitter.com/TenArmorAlert/status/1915649260499910854 TenArmor - "Our system has detected multiple suspicious attacks involving #Zora @zora on #BASE, resulting in an approximately loss of $140.8K." - Twitter/X] (Accessed Aug 5, 2025)</ref>

<ref name="latestattack-20908">[https://basescan.org/tx/0xba499a75765e06cdb49c3ca1714dc5af6cac23fa7c805004867dd4a32da1e2e0 The Latest Attack Transaction - BaseScan] (Accessed Aug 5, 2025)</ref>

<ref name="setallocations-20909">[https://basescan.org/tx/0xf71a96fe83f4c182da0c3011a0541713e966a186a5157fd37ec825a9a99deda6 setAllocations for the BaseSettler Contract - BaseScan] (Accessed Aug 5, 2025)</ref>

<ref name="attacktransaction-20910">[https://basescan.org/tx/0x84367a86229b4868e0224e0ffdc4a78354769c52102850733b3e1f4daf015f6e An Attack Transaction - BaseScan] (Accessed Aug 5, 2025)</ref>

<ref name="zoratwitterx-20911">[https://twitter.com/zora Zora.co Twitter/X] (Accessed Aug 5, 2025)</ref>

<ref name="zorahomepage-20912">[https://zora.co/ Zora.co Homepage] (Accessed Aug 5, 2025)</ref>

<ref name="zoraaboutpage-20913">[https://zora.co/about Zora.co About Page] (Accessed Aug 5, 2025)</ref>

<ref name="basetweet-20914">[https://twitter.com/base/status/1950941798916091989 Base Network - "The (New) Creator Economy. Find out what attention is worth with @zora. Every post and profile on Zora is a coin. When people trade them, creators earn." - Twitter/X] (Accessed Aug 5, 2025)</ref>

<ref name="blogmexc-20915">[https://blog.mexc.com/what-is-zora/ What is ZORA? Complete Guide to ZORA Network’s Revolutionary Memecoin ($ZORA) - Mexc Blog] (Accessed Aug 5, 2025)</ref></references>

Zora BaseSettler BaseSettlerMetaTxn Mistakenly Claimable - Revision history