Land of Genesis Mint Permission Hack

Notice: This page is a freshly imported case study from the original repository. The original content was in a different format, and may not have relevant information for all sections. Please help restructure the content by moving information from the 'About' and 'General Prevention' sections to other sections, and add any missing information or sources you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

Land of Genesis NFT

The Land of Genesis NFTs don't appear to have a widely known homepage. There are a maximum of 1,500 of them. An attacker appears to have minted a portion of NFTs that weren't supposed to be minted. Most funds remain in the attacker's wallet.

This is a global/international case not involving a specific country.

About Land of Genesis

Information About:

Smart Contract:

"Land of Genesis NFT is the ecological core andeconomic construction foundation of Miracle Farm,with a total of 1500 scarce resources.If you ownland NFT will get the entrance ticket of MiracleFarm ecology."

"Today, $LAND was exploited for 200 NFTs, caused by a lack of permission control on mint"

"The DeFi protocol land was suspected of being attacked and lost about 150,000 US dollars. The reason for the attack was the lack of mint permission control."

"Odaily Planet Daily News According to Beosin EagleEye’s security risk monitoring, early warning and interruption platform monitoring under the block chain security audit company Beosin, on May 14, Beijing time, DeFi Agreementland was suspected of being attacked, with a loss of approximately US$150,000. Beosin Trace traced and found that 149,616 BUSDs have been stolen."

"The reason for the attack was the lack of mint authority control. Specifically, there are several miner addresses at the （ project side mint NFT, including 0x2e59983715d2f92468fa5ae3f9aab4e930e3ac78; ）2（ attacker call 0x2e59，Use the NFT cast in the previous step to exchange a large amount of XQJ tokens （ for each NFT to 200 XQJ） until the contract cannot be replaced by XQJ; （4） The attacker exchanged 149,616 BUSDs;（5."

"Some of the miner addresses of the project can mint unlimited quantity of NFTs, including this wallet: 0x2e599883715d2f92468fa5ae3f9aab4e930e3ac7"

"The scammer calls 0x2e599883715d2f92468fa5ae3f9aab4e930e3ac7 contract to mint 200 NFTs"

"Then, the scammer calls the 0x2c672a34 function of the 0xeab03ad7ea0ac5afb272b592bef88cf93ed190c5 contract to swap for a large amount of $XQJ using the previous minted NFTs (200 $XQJ per NFT)

The attacker swaps 28,601 $XQJ for 149,616 $BUS"

"The scammer minted NFTs again until the NFT issue limit was reached"

"Most of the stolen funds are still at the attacker's address."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

• Known history of when and how the service was started.
• What problems does the company or service claim to solve?
• What marketing materials were used by the firm or business?
• Audits performed, and excerpts that may have been included.
• Business registration documents shown (fake or legitimate).
• How were people recruited to participate?
• Public warnings and announcements prior to the event.

Don't Include:

• Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
• Anything that wasn't reasonably knowable at the time of the event.

There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

• When the service was actually started (if different than the "official story").
• Who actually ran a service and their own personal history.
• How the service was structured behind the scenes. (For example, there was no "trading bot".)
• Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.

Key Event Timeline - Land of Genesis Mint Permission Hack

Date	Event	Description
May 14th, 2023 10:39:50 AM MDT	Malicious Minting Transaction	The malicious minting transaction occurs on the Binance Smart Chain. In this transaction, 200 NFTs are minted by the attacker exploiting the lack of validation.
May 15th, 2023 12:42:03 AM MDT	Foresight News Report	Foresight News reports on the incident (in Chinese).
May 15th, 2023 12:46:00 AM MDT	Beosin Alert on Twitter	An alert is flagged on Twitter by Beosin.
May 15th, 2023 1:57:00 AM MDT	DeDotFiSecurity Report	A technical analysis is shared on DeDotFiSecurity Twitter.

Technical Details

This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

Smart Contract:

DeDotFiSecurity Technical Analysis

The DeDotFiSecurity Twitter posted a technical analysis explaining the exploit on Twitter.

~$150,000 Exploit Alert

Today,  $LAND was exploited for 200 NFTs, caused by a lack of permission control on mint

Here`s the on-chain flow of the attack

1/ Exploit tx https://bscscan.com/tx/0xe4db1550e3aa78a05e93bfd8fbe21b6eba5cce50dc06688949ab479ebed18048

Some of the miner addresses of the project can mint unlimited quantity of NFTs, including this wallet: 0x2e599883715d2f92468fa5ae3f9aab4e930e3ac7

The scammer calls 0x2e599883715d2f92468fa5ae3f9aab4e930e3ac7 contract to mint 200 NFTs

2/ Then, the scammer calls the 0x2c672a34 function of the 0xeab03ad7ea0ac5afb272b592bef88cf93ed190c5 contract to swap for a large amount of $XQJ using the previous minted NFTs (200 $XQJ per NFT)

The attacker swaps 28,601 $XQJ for 149,616 $BUS

3/ The scammer minted NFTs again until the NFT issue limit was reached

Total Amount Lost

The total amount lost has been estimated at $150,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

Ultimate Outcome

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

What parts of this case are still remaining to be concluded?

General Prevention Policies

Multi-signature.

Individual Prevention Policies

No specific policies for individual prevention have yet been identified in this case.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Policies for platforms to take to prevent this situation have not yet been selected in this case.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

No specific regulatory policies have yet been identified in this case.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.