Legendary NXT developers Larva Labs succumbed to an exploit this morning as an attacker found a way to collide a rare NXT worth more than $ 700,000 from the “Meibits” collection.
The attacker, 0xNietzsche, teased the exploit on Twitter this morning, saying that he had estimated to make “$ 300,000 per hour” during the duration of the attack. He has since deleted the tweets, saying that he came across as a “douche”.
Certainly some regrettable tweets were sent in the last few hours. After coming down and processing they all make a lot of sound.
– 0xNietzsche (@ 0xNietzsche) 8 May, 2021
His attack essentially focused on “mending” his meibit mints, until the contract gave him what he wanted. The MeBits contract includes a zipped interplenary file system file, which reveals the characteristics of each Maybet’s ID. The IDs of the remaining mebits are public knowledge, but did not have their characteristics until the knowledge of the IPFS leak spread. As a result, 0xNietzsche simply needs to create a list of desirable IDs, and design a contract that mines Meebit repeatedly, but it cancels the transaction if it does not find a compatible ID.
An Etherscan address represents 345 total transactions, hundreds of which have failed to “roll” to obtain desirable meebits. The only successful roll appears to be Meebit 16647, a “visitor” or foreigner. On 16647 the collector-whale prank was purchased for 200 ETH. According to Opentia, the next lowest-priced visitor, Meibit, is listed for 300 ETH.
Step 1) tagged in @ Hi @ Power.
Step 2) View Visitors #Mebit For 200 ETH ($ 700K) @open sea.
Step 3) buy #Mebit
Step 4) Heard about mint exploitation, stopped by exploitation @ Hi.
Step 5) Capture and keep the visitor #Mebit # 16647
https://t.co/MlBqZc5Mxq#Nft #AlwaysLiquid pic.twitter.com/vxHMqj13SE
– Pranxi (@pranksyNFT) 8 May, 2021
In a pinned post in their Discord, Larva Labs announced that they had closed the market.
“We have temporarily halted community mining and trading in the Meibits contract. The contract is secured, all Meebit are secured, and the business is working fine, ”the announcement reads in part.
While the mining period of Meibits was scheduled to end on Monday, the owners of some cryptocurrencies and Onglyphs (each of whom are entitled to Mebit on a one-to-one basis) have probably not redeemed themselves yet. As a result, the Larva Labs team plans to “provide a form where you can use your wallet to sign a message that proves the ownership of your penalty / glyph, and we use the ‘devMint’ function. Meebits will do the mint for you by using. Allows users to continue the mint through the weekend, while preventing others from using the exploit.
By 0xNietzsche’s own projections, his exploitation could have been far more successful. Per Post in Discord, looking at the length of the attack before the market closed, he felt he should “get two meebs in that hour.” He also mentioned that his contract cost is “~ $ 20k an hour in gas fees” and that he had to buy penalties with improper meebits for exploitation so as to work, his total pay would be reduced due to the total costs:
In the now-deleted tweet, he said that he participated in “50 ETH and 5 floor convictions” from exploitation.
An anonymous source told Cointeclague that other NXT collectors were aware of the attack vector, but opted not to exploit it because they felt it would be “unethical”. Yesterday’s tweet showed that others were actually aware of the IPFS leak and had identified the lowest remaining 10,761, a “dissected” Meebit, which was among 0xNietzsche’s targets.
Another dissected Meebit is “missing”, there is still to be mined.
This is # 10761. https://t.co/xgP2FJKhCw pic.twitter.com/W0Vi5HIECS
– pixels (@pixls_dot_eth) 7 May, 2021
The community is currently publicly debating what this would mean for prices in the Meibits and the wider Larva Labs space. Many believe that exploitation being “contradictory” can raise floor prices for projects.
Historical importance may play a major role in the price of NFT. Earlier this year, digital archaeologists uncovered “Mooncats”, which many thought of as a second NXT project, creating a temporary buying frenzy. 0xNietzsche is a Mooncats enthusiast.