Munchables Rogue Developer Theft

Notice: This page is a new case study and some aspects have not been fully researched. Some sections may be incomplete or reflect inaccuracies present in initial sources. Please check the References at the bottom for further information and perform your own additional assessment. Please feel free to contribute by adding any missing information or sources you come across. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

Munchables Logo/Homepage

Munchables was an NFT game built on the Blast blockchain. Shortly after the project had garnered a significant investment, it was found that one of the developers had created and exploited a back door allowing them the ability to withdraw all of the funds. After some heated coaxing, the developer was ultimately found to be willing to return all of the funds.

This is a global/international case not involving a specific country.

About Munchables

"Munchables" introduces players to a world where Schnibbles, unique and distinctive snacks, grow in various realms. With Munchables, players are tasked with restoring reality after accidentally blasting the peaceful world of the Munchables out of existence. The game involves reuniting clans divided between ethereal realms. Backed by various investors, the project promises rewards such as Schnibbles, Munch points, Blast points, Blast gold, and Blast airdrop. The timeline includes preparations for Season 2, redemption rewards distribution, and unlocking rewards during Season 2. Players can explore Snuggery and earn rewards by bringing scattered Munchables back together. The game is built to maximize Blast rewards with native yield and airdrops.

Each realm has its own schniblet, affecting how Munchables react based on compatibility. Players choose the location of their snuggery, impacting feeding effects. Schnibbles accrue passively, with harvesting rates tied to player TVL in lockdrop. Feeding Munchables is possible once imported into the snuggery, with a limit of 6. The game's goal is to farm Munch Points, paid daily and claimed manually to avoid proportional redistribution. Daily claim share depends on the aggregate level of all Munchables in the snuggery. The game encourages players to dive deeper into the realms of the Munchables to nurture them, level up, and unlock their true potential.

"Oops. We blasted the peaceful world of the Munchables out of existence. The clans are now divided between ethereal realms. Our mission is to reunite them."

The Reality

It appears that the Munchables founders had mistakenly hired an individual who played out 4 separate identities as their development "team".

As a new chain, Blast protocol had recently suffered an attack within the past week.

What Happened

A rogue developer installed a backdoor in the Munchables project, which they later exploited to withdraw $62.5 million.

Key Event Timeline - Munchables Rogue Developer Theft

Date	Event	Description
March 26th, 2024 3:37:00 PM MDT	Compromise Tweet	The compromise is noted in a public tweet. The Munchables team is "tracking movements and attempting to stop the the transactions".
March 26th, 2024 10:29:00 PM MDT	ZachXBT Tweet	ZachXBT notes a suspicion that the developers are most likely all the same person.
March 27th, 2024 3:04:00 PM MDT	Rekt News Article	Rekt News captures details of the exploit and return of funds.
April 4th, 2024 4:51:00 PM MDT	Full Refund Tweet	The Munchables project posts on Twitter that all users have been fully refunded. The next step they promise is processing Blast rewards for all original lockdrop participants, followed by embarking on the next phase.

Technical Details

GitHub usernames:

• NelsonMurua913
• Werewolves0493
• BrightDragon0719
• Super1114

Ethereum addresses:

• 0x4890e32a6A631Ba451b7823dAd39E88614f59C97
• 0x6BE96b68A46879305c905CcAFFF02B2519E78055
• 0x9976Fe30DAc6063666eEA87133dFad1d5ec27c5E

Exchange deposit addresses:

• 0x84e86b461a3063ad255575b30756bdc4d051a04b
• 0xe362130d4718dc9f86c802ca17fe94041f1cfc77

"Four different devs hired by the Munchables team and linked to the exploiter are likely all the same person"

"The Blast L2 Big Bang award-winning project Munchables was exploited for $62.5M by a rogue dev. Funds retrieved from dev within a few hours in a rollercoaster ride of a day."

Total Amount Lost

The total amount lost has been estimated at $62,500,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

The Munchables team quickly reported the compromise and attempted to stop the transactions. There were rumors about the possibility that a North Korean developer, hired by mistake, was behind the attack. ZachXBT took action against the rogue developer, possibly saving the day.

"Munchables has been compromised. We are tracking movements and attempting to stop the the transactions. We will update as soon as we know more."

Reactions On Twitter

Munchables exploited. #rekt for 11 ETH. My pets will be never be petted again

Blast devs can surely revert the tx, after all it's a centralized rollup?

Investigation Into Developer

ZachXBT found suspicion with the development team hired by Munchables.

Four different devs hired by the Munchables team and linked to the exploiter are likely all the same person as they:

>recommended each other for the job

>regularly transferred payments to the same two exchange deposit addresses

>funded each others wallets

Ultimate Outcome

Funds were eventually retrieved from the developer, who was exposed by ZachXBT. The developer agreed to return the funds, and roughly $60.5 million was transferred back to Munchables.

Distribution Back To Affected Users

The recovered funds were ultimately distributed back to all affected users.

"We can confirm that the full refund distribution process has now been completed.

Next up is processing the Blast rewards to all OG lockdrop players.

Then, we begin the next chapter.

Get ready to Munch"

Total Amount Recovered

All recovered funds were ultimately distributed back to all affected users.

The total amount recovered has been estimated at $62,500,000 USD.

Ongoing Developments

The team still needs to process "Blast rewards to all OG lockdrop players".

Individual Prevention Policies

Avoid the use of smart contracts unless necessary. Minimize the level of exposure by removing or withdrawing assets whenever possible. Aim to choose smart contracts which have obtained third party security audits, preferably having been audited by at least three separate reputable firms. Pay attention to the audit reports, which smart contracts are covered, and whether the smart contract has been upgraded or modified since the report. Ensure that any administrative functions with the ability to remove funds from the smart contract are under the authority of a multi-signature wallet which is controlled by at least three separate and reputable entities.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

The primary issue was that there was no review of the smart contract post-deployment, which would have uncovered the large balance that had been applied.

All aspects of any platform should undergo a regular validation/inspection by experts. This validation should include a security audit of any smart contracts, reporting any risks to the backing (of any customer assets, ensuring treasuries or minting functions are properly secured under the control of a multi-signature wallet, and finding any inadequacies in the level of training or integrity of the team. The recommended interval is twice prior to launch or significant system upgrade, once after 3 months, and every 6 months thereafter. It is recommended that the third party performing the inspection not be repeated within a 14 month period.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

The primary issue was that there was no review of the smart contract post-deployment, which would have uncovered the large balance that had been applied.

All platforms should undergo published security and risk assessments by independent third parties. Two assessments are required at founding or major upgrade, one after 3 months, and one every 6 months thereafter. The third parties must not repeat within the past 14 months. A risk assessment needs to include what assets back customer deposits and the risk of default from any third parties being lent to. The security assessment must include ensuring a proper multi-signature wallet, and that all signatories are properly trained. Assessments must be performed on social media, databases, and DNS security.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.