Shamanzs NFT Unfair Dutch Auction

Notice: This page is a new case study and some aspects have not been fully researched. Some sections may be incomplete or reflect inaccuracies present in initial sources. Please check the References at the bottom for further information and perform your own additional assessment. Please feel free to contribute by adding any missing information or sources you come across. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Shamanzs

Shamanzs is a set of collectible NFT characters designed by a known team in Barcelona. The NFTs came to be listed on the widely used OpenSea marketplace, however the team changed the URL of the listing near the launch itself. A number of references pointed their community to the old link, and as a result many members were directed there. A scammer was then able to set up a fake listing at the old link, which directed members to buy different and non-official NFTs.

The Shamanzs team came up with a plan to provide refunds and discounted NFTs to those affected through a minting website. However, they only gave affected users 24 hours (plus 1 hour of advanced notice prior to the launch) in which to claim their refunds. While the process was reported to have proceeded smoothly, there was at least one user reporting issues claiming the refund. Since that time, the original tweets related to the refund process and the issue have been removed from Twitter, while Shamanzs account itself is still actively posting to promote new NFT collections.

About Shamanzs

Shamanzs is an original collection of 9898 programmatically generated NFTs on the Ethereum and Solana blockchains. The renowned design studio Brosmind, led by brothers Juan and Alejandro, is involved in the creation of Shamanzs. The founding team of Shamanzs shares a passion for art, technology, music, and the digital world. Led by the talented brothers Juan and Alejandro, the studio has worked with major brands such as Nike, Coca-Cola, and Google. The Shamanzs brand focuses on great art and promoting a "Good Vibes Only" movement with a brand which focuses on positive energy and experiences. The high-quality artwork and unique shaman theme make the project stand out.

Holders of Shamanzs NFTs will receive exclusive rewards, including access to future art, airdrops, merchandise gifts, discounts in the online shop, and invitations to both physical and digital events.The team consists of the artist duo, two additional co-founders, and three other team members. While the co-founders remain somewhat anonymous, their public presence through social media mitigates any concerns. The creators prioritize quality over a speedy launch and aim to build a lasting brand around Shamanzs.They bring together their unique skills and connections to turn Shamanzs into a long-lasting brand. Shamanzs fall under a new category of NFTs that are designed and built slowly to ensure art quality, becoming visually appealing."

The collection was originally minted on May 19th, 2021, and features hand-drawn traits to create unique and high-quality loving characters. All Shamanzs follow the ERC721 NFT standard, ensuring adaptability and durability. The team is planning a distribution strategy to maximize availability during the minting stage.

Each NFT serves as a secret pass to the Shamaverse, which combines digital and physical world utility. The story revolves around wise monks, sadhus, gods, and gurus from different ancient religions coming together to spread love and positive energy. They form a unified legion called Shamanzs, aiming to eradicate negative energies from Earth. This movement is catching the attention of dormant ancient gods.

The project aims to create a vibrant and engaging community for NFT enthusiasts.The Shamanzs project has garnered a large Twitter community which reportedly had over 137,000 Twitter followers and 48,000 Discord members. The engagement within the community is high. The launch mechanics of Shamanzs follow a multi-stage private sale and a public Dutch auction, with only 1,860 NFTs available to the public. Given the project's popularity, it is expected to sell out quickly during the Dutch auction, which starts at a price of 0.5 ETH and gradually decreases every 15 minutes until reaching 0.15 ETH.

The FAQs section on their website provides information about NFTs, Metamask (a digital wallet for purchasing Shamanzs), and the uniqueness of Shamanzs.

The Reality

While the blockchain provides a high level of security around assets, participation in NFT projects requires multiple layers of trust, including that the project delivers what's promised, that communication is actually received from that project and not a malicious actor, and that mistakes were not made. Unfortunately, many protocols and users may not take the necessary precautions, which may result in a loss of funds.

What Happened

The Shamanzs OpenSea link was switched from "shamanzs-v3" to "shamanzs-official" prior to launching the collection and some of the links failed to update. An opportunistic scammer reportedly set up a scam collection on the original "shamanzs-v3" link and was able to trick some users.

Key Event Timeline - Shamanzs NFT Unfair Dutch Auction

Date	Event	Description
April 28th, 2022 8:12:23 AM MDT	TechMoneyCulture Article	A TechMoneyCulture article features Shamanz on the list of "3 Best NFT Drops to Kick Off May 2022".
May 3rd, 2022 5:20:00 PM MDT	OpenSea Link Live on Twitter	The Shamanzs team reports that the "[o]fficial] [OpenSea] link is no[w] live". (Tweet has since been deleted. TBD No way to confirm timezone. Known to be prior to 6:20 PM, and makes sense it would have to be prior to the sell out announcement.)
May 3rd, 2022 6:12:00 PM MDT	Sell Out Twitter Announcement	The Shamanzs team posts on Twitter to announce their "Fair Dutch Auction sold out [in] under 3 min[utes]" and that "Phase 2 (WL) [would be] starting at 10 PM (EST)". (Tweet has since been deleted.)
May 4th, 2022 3:11:21 AM MDT	Clarification and Issue Reported Fixed	Shamanzs announces that there was an issue with the minting process of the Shamanzs NFT collection. A scammer created a fake collection under the name "shamanzs-v3" on OpenSea, causing confusion among participants. The team quickly resolved the issue and clarified that the official collection is named "shamanzs-official." Some people panicked and started selling their tokens, but the team reassured the community that the Shamanzs collection is legitimate and their goal is to create a long-lasting project. The team is working on the next steps and will provide further updates soon. Another mint is open until 11 PM CET.
May 4th, 2022 4:30:23 AM MDT	Lack Of Contact Apology	The Shamanzs team apologizes for the lack of communication and acknowledges the impact of recent FUD (Fear, Uncertainty, and Doubt) on the community. They express their care for the community and state that they are taking serious actions to address the situation. The team plans to compensate those affected by the Fair Dutch Auction and are currently working on developing a refund tool that will be accessible on their website. They appreciate the support they have received from the community.
May 4th, 2022 4:32:23 AM MDT	Mint Suspended And Refunds Offered	The Shamanzs team posts that the WL mint is suspended and proposed a refund to be done to all members who bought the fake NFTs. They have taken a snapshot of the users who bought from the fake collection to use to determine refunds.
May 5th, 2022 9:57:12 AM MDT	Tool Currently Being Tested	The Shamanzs team announces that the refund tool they've developed is currently being tested.
May 5th, 2022 1:39:02 PM MDT	Community Is Army Relaunch Plan	"Shamanzs feeling stronger, united and unbeatable. Motivation level ath. Relaunch plan being built up (to be revealed soon). Community = army"
May 6th, 2022 3:45:35 AM MDT	Further Details About Attack Provided	Shamanzs provides further details to their community about the unfortunate incident involving a name change on OpenSea. The name change was deemed misleading, and a scammer exploited the situation by creating a fake collection under the same name. This led a small portion of the community to fall victim to the scammer. However, a plan is being developed and will soon be implemented to address the situation.
May 6th, 2022 6:06:01 AM MDT	Announcing Refunds In 1 Hour	The Shamanzs team announces that refunds will be made available in an hour.
May 6th, 2022 7:01:40 AM MDT	Refund Process Online Announcement	Shamanzs announces their refund page is now live for 24 hours and provides instructions on how to claim refunds. "Claim your refund tool" is now live for the next 24h. After that period, refunds won't be available.
May 6th, 2022 10:46:26 AM MDT	Smooth Refund Process	The refund process reportedly went smoothly. "Very happy to hear that claim your refund experience is going smoothly. Now it’s time to build up, again. Get ready"
May 7th, 2022 7:18:14 AM MDT	A New Shamanzs Era	"A new Shamanzs era has now officially started."
May 8th, 2022 2:40:27 PM MDT	Biggest NFT Space Comeback	Shamanzs announces "the biggest comeback in the NFT space". "As we speak, we aim for a relaunch on 17/18th May. As it is hard to give a specific day in advance it's an estimated date, however take for granted the Shamanzs Devs are working tirelessly to make you meet your Shamanzs as soon as possible."
May 11th, 2022 1:38:32 PM MDT	Shamanzs Twitter Announcement	Shamagang announces an airdrop and secret utility being developed for the ShamaPass, which combines the existing benefits with additional secret benefits. The current benefits for ShamaPass holders include airdrops of the genesis collection, access to exclusive raffles for music festivals, secret concerts, and NFT NYC tickets, and access to specific holder channels. In addition to these benefits, ShamaPass holders will receive a unique 2036 OG Collection designed by Brosmind, with each holder receiving one airdrop. The 2036 OG Collection will have its own lore and meaning, inspired by a powerful and unrevealed 1/1 item. Holding the ShamaPass grants the right to claim one NFT from the 9898 Shamanzs Genesis Collection and an airdrop of the 2036 OG Collection. The mechanics involve automatically keeping wallets after claiming the 9898 collection NFT and later airdropping the new ShamaPass to each wallet. The new ShamaPass will have the same benefits, except for the claimable NFT, and ShamaPasses with pending claims may have a limited trading period. ShamaPasses that already claimed the NFT will be burnt and trades won't be available. The new ShamaPass will be airdropped to saved wallets once the new contract is available.

Technical Details

According to the Shamanzs report, the issue happened as a result of the OpenSea auto-listing feature, which created a listing at the URL "shamanzs-v3". The Shamanzs team quickly changed this URL to "shamanzs-official", however an opportunistic scammer reportedly set up a malicious listing at the "shamanzs-v3" URL and tricked a small number of users into making purchases there.

OpenSea Auto-Listing Feature

TBD - Need to better explain how the OpenSea auto-listing feature works.

Scammer Sets Up Shamanzs-v3 Link

There was reportedly the ability for a scammer to set up a listing on the recently used "shamanzs-v3" URL.

https://support.opensea.io/hc/en-us/articles/4407762843155-How-do-I-create-a-collection-

https://support.opensea.io/hc/en-us/articles/360063498333-How-do-I-sell-an-NFT-

Users Purchased The Fraudulent NFTs

"[A] small portion" of the Shamanz community reportedly purchased the fraudulent NFTs on the "shamanzs-v3" account, which was unrelated to the Shamanzs team.

Total Amount Lost

The total amount lost is unknown. TBD - This needs to be calculated. Can we get blockchain records of what was actually sold?

TBD - There was likely some additional loss in the aftermath as people panicked?

Immediate Reactions

Shamanzs Team Posts Summary On Twitter

The Shamanzs team posted a summary of the events and outcome.

Shamagang, you must be wondering what’s going on with the mint:

The collection was auto listed on Open Sea under shamanzs-v3. We quickly changed it to shamanzs-official, but a scammer parked a fake collection at shamanzs-v3.

The issue with the fake account was fixed quickly, but some people panicked and began selling thinking it was a fake collection.

The official Open Sea link is: shamanzs-official

The team is working hard to figure out the next steps. We’ll let you know more soon. For now, know that the Shamanzs collection and project is solid, and our goal is to make it a long lasting one.

Unique art, strong doxxed team, and values based on the GVO concept is what Shamanzs is all about.

WL mint is open until 11pm CET. Official premint site:

Market Panic Sales Of Real Shamanzs NFTs

There were reportedly many users who immediately sold their legitimately purchased Shamanzs NFTs. While some users may have been selling in anticipation of the project reputation damage or out of a concern for the panic of others, many users are believed to have erroneously thought that they purchased the wrong NFT due to the limited details available at the time. TBD - Need to fill in details here about users. Back up with sources from blockchain if possible.

Further Details On Attack

Shamanzs clarified what happened with a follow up tweet.

Hi ShamaGang,

We would like to share with everyone some important information and evidence of what happened during/after the FDA sold out.

As you all know, we had our name changed on OS since it appeared to be misleading and that resulted into something unfortunate, where a scammer took advantage of this creating a false collection under the same name.

With the links not being updated ,this led a small portion of our amazing community that we care about to the scammers OS ultimately resulting in them being taken advantage of. With that being said, we have a plan that's soon to be implemented.

Suspension of Whitelist Minting Process

The Shamanzs team suspended their present whitelist minting process, preventing further minting of NFTs. TBD expand with more details. Can we get exact timing and a blockchain transaction here?

Shamanzs Team Offers Refunds

Around an hour later, the Shamanzs team posted that they would be providing refunds to all affected users.

Hey @ShamaGang, sorry for the lack of communication recently, we were working on a solution to help all of you.

As always, we care a lot about our community and were devastated by the last FUD we got, we heard your feedbacks and we are taking serious actions on it :

We will be refunding .35 ETH to all those who minted at 0.5 ETH, make the mint price to .15 ETH, based on floor price, we don't want anyone to lose money.

We will be also refunding all those who bought from the fake collection, we took a snapshot of the wallets already(if you buy  now you won't be refunded)

WL mint is currently suspended, we will open it again, we will do a refund, that is claimable for all the WL members, of .044 ETH per nft, that makes the mint to .1 ETH.

Ultimate Outcome

The Shamanzs team ultimately set up a refund tool which would pay out a refund in Ethereum based on the number of NFTs which the user minted. This process reportedly ran smoothly, and the Shamanzs team decided they would remove all record of the incident from Twitter.

Creation of Online Refund Tool

"WL mint is currently suspended, we will open it again, we will do a refund, that is claimable for all the WL members, of .044 ETH per nft, that makes the mint to .1 ETH."

"We will be updating how we progress on our mission to compensate everyone that was affected post Fair Dutch Auction sold out on OS. The first step is to build a refund tool that will be available on our website, which is currently under development."

"We appreciate your patience, The dev team has been working hard, and a tool is currently being tested. We expect to have it available on our website really soon. To make things right, each wallet that minted during FDA will be able to claim a refund of 0.35 ETH per mint."

""Claim your refund tool" is now live for the next 24h." "If you minted during FDA, you can now claim your refund." "Click the green top right button of the screen, and connect the same wallet you used to mint with. [T]hanks for your patience."

"We will be refunding .35 ETH to all those who minted at 0.5 ETH, make the mint price to .15 ETH, based on floor price, we don't want anyone to lose money." "We will be also refunding all those who bought from the fake collection, we took a snapshot of the wallets already(if you buy now you won't be refunded)."

"The system will automatically refund based on total number of mints per wallet: 1 NFT minted = 0.35 ETH, 2 NFT minted = 0.70 ETH, 3 NFT minted = 1.05 ETH. Feel free to share, in case you now someone who minted on FDA." "After [24 hours], refunds won't be available."

Refund Process Reportedly Ran Smoothly

.

"Very happy to hear that claim your refund experience is going smoothly. Now it’s time to build up, again. Get ready."

"Shamanzs feeling stronger, united and unbeatable. Motivation level ath. Relaunch plan being built up (to be revealed soon). Community = army." "We're only looking up, and that means not even the moon is high enough fo the ShamaGang now!"

Removal Of Twitter Post History

While the Shamanzs Twitter account is still live, tweets related to the theft have been removed.

The Shamanze Twitter account has been steadily losing followers and currently sits at 89.9k.

Total Amount Recovered

Refunds were available for 24 hours. The refund was provided based on the number of Shamanzs NFTs which the user minted.

1 NFT minted = 0.35 ETH - 2 NFT minted = 0.70 ETH - 3 NFT minted = 1.05 ETH

"Claim your refund tool" is now live for the next 24h. After that period, refunds won't be available.

Shamansz reported that there was a smooth refund process on Twitter.

Includeing even if the NFT had been resold.

The total amount recovered is unknown.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

The Shamanzs NFT collection continues to exist on OpenSea. OpenSea has been working on their stolen items policy following the previous thefts.

OpenSea Stolen Items Policy

https://support.opensea.io/hc/en-us/articles/4815371492499

https://web.archive.org/web/20230107194342/https://support.opensea.io/hc/en-us/articles/4815371492499

TBD - Did the OpenSea platform introduce their stolen items policy after this incident?

Individual Prevention Policies

The OpenSea collection listing process was reportedly an automatic process, which failed to provide confirmation of the address. Fundamentally, this should not only require confirmation, but be controllable through a multi-signature wallet. The Shamanzs team should not be able to post a new mint without obtaining the approval from at least 3 separate team members. This should be done in a careful and controlled manner. While users have limited control over the policies implemented by the platforms they use, they can exert pressure and choose to avoid platforms which are insufficiently audited and have weak security controls.

Avoid the use of smart contracts unless necessary. Minimize the level of exposure by removing or withdrawing assets whenever possible. Aim to choose smart contracts which have obtained third party security audits, preferably having been audited by at least three separate reputable firms. Pay attention to the audit reports, which smart contracts are covered, and whether the smart contract has been upgraded or modified since the report. Ensure that any administrative functions with the ability to remove funds from the smart contract are under the authority of a multi-signature wallet which is controlled by at least three separate and reputable entities.

Those who ended up purchasing the scam NFTs accessed the purchase through official links, likely on the OpenSea marketplace. While there are some opportunities (such as Shamanzs) that would be entirely missed out on by delaying, taking the time to be diligent is a much more prudent strategy overall. While users may have missed out on this particular mint by carefully checking URLs, there are many other NFTs available, and the Shamanzs NFTs were also available at considerable discount in the ensuing panic shortly after the minting process.

Every approval on Web3 is an opportunity to lose all of the funds present in your wallet. Take the time to review the transaction in full. Fully check over the balance, permissions, and entire address which you are interacting with. Do not trust that your clipboard or any website front-end is guaranteed to provide an accurate address or transaction status. Always perform a test transaction prior to the first high-value transaction in any session.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

The OpenSea collection listing process was reportedly an automatic process, which failed to provide confirmation of the address. Fundamentally, this should not only require confirmation, but be controllable through a multi-signature wallet. The Shamanzs team should not be able to post a new mint without obtaining the approval from at least 3 separate team members. This should be done in a careful and controlled manner.

Avoid the use of smart contracts unless necessary. Minimize the level of exposure by removing or withdrawing assets whenever possible. Aim to choose smart contracts which have obtained third party security audits, preferably having been audited by at least three separate reputable firms. Pay attention to the audit reports, which smart contracts are covered, and whether the smart contract has been upgraded or modified since the report. Ensure that any administrative functions with the ability to remove funds from the smart contract are under the authority of a multi-signature wallet which is controlled by at least three separate and reputable entities.

Special care needs to be taken for launch links on projects. These need to be decided ahead of time and not changed. OpenSea should ideally never allow a link to be reassigned to another project, though it could also be allowed without a manual review process and the protection of a multi-signature wallet.

Providing 24 hours for refund claiming is not likely to be sufficient, especially given the prevalence of phishing attacks in the NFT space. Users should be provided adequate time to become up to date and ensure the refund is legitimate. As this can be a burden on platforms in times of crisis, it may be better to have a delegated entity which focuses on handling compensation for affected users.

Work with other industry platforms to set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

All platforms should undergo published security and risk assessments by independent third parties. Two assessments are required at founding or major upgrade, one after 3 months, and one every 6 months thereafter. The third parties must not repeat within the past 14 months. A risk assessment needs to include what assets back customer deposits and the risk of default from any third parties being lent to. The security assessment must include ensuring a proper multi-signature wallet, and that all signatories are properly trained. Assessments must be performed on social media, databases, and DNS security.

Set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services within the country, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.