Key Highlights
- On June 8, Yuga Labs executed a successful whitehat intervention following a security breach in Flooring Protocol
- The operation secured 68 valuable NFTs including Bored Apes, CryptoPunks, Azuki, Doodles, and Moonbirds, valued at more than $500,000
- The security flaw enabled malicious actors to create virtually unlimited tokens and extract NFTs from liquidity pools
- Users have been cautioned against making additional deposits until the security issue is fully addressed
- Developers are collaborating to implement a solution and return the recovered digital assets to their rightful owners
In a swift emergency response on June 8, Yuga Labs successfully recovered 68 valuable NFTs following the discovery of a critical security vulnerability in Flooring Protocol, a decentralized platform enabling users to deposit NFTs in return for fungible token equivalents.
Michael Figge, serving as CEO, verified that the recovery mission concluded successfully with all assets now secured under Yuga Labs’ protection.
The recovered digital assets comprised 29 Bored Apes, 4 Mutant Apes, 1 BAKC, 2 CryptoPunks, 1 Azuki, 2 Elementals, 26 Captains, 1 Moonbird, and 2 Doodles.
Technical Breakdown of the Vulnerability
The security flaw enabled attackers to convert minimal WETH deposits into virtually unlimited fpToken balances—the protocol’s native fungible tokens.
Yuga Labs blockchain specialist 0xQuit detailed how the vulnerability stemmed from issues in packed ownership structures and indexing mechanisms. A carefully crafted token ID could satisfy ownership verification while producing different results in the accounting system.
This phenomenon, which 0xQuit termed “ghost ownership,” was compounded by an unchecked balance adjustment that triggered an underflow error, artificially inflating attackers’ token holdings to astronomical levels.
Armed with these inflated balances, bad actors could manipulate token prices toward zero, drain pool liquidity, and subsequently claim the NFTs backing those tokens.
Emergency Recovery Process
Yuga Labs’ specialized trading division, GrailsOTC, provided the necessary capital and NFT assets to evacuate at-risk tokens from compromised pools ahead of potential attackers.
Cybersecurity expert Coffee contributed to the rescue efforts. Several collections had already suffered losses before the team comprehensively identified the threat scope.
According to 0xQuit’s valuation, the salvaged assets exceeded $500,000 in total value.
Yuga Labs has committed to safeguarding these NFTs and coordinating with Flooring Protocol’s engineering team to facilitate their return following the deployment of security patches.
Ongoing Security Concerns
Lead developer 0xFreeLunch acknowledged that the exploit impacted both Flooring Protocol V2 and BitmapPunks platforms.
Both systems utilized smart contracts featuring 1:1 fungible token pegs to deposited NFTs. The vulnerability permitted unauthorized minting and redemption of excess tokens, despite undergoing multiple independent security assessments.
0xFreeLunch revealed that the attack vector proved more extensive than initial exploiters seemed to recognize. The identical vulnerability also compromised liquidity pools owned by the BitmapPunks development team.
0xQuit issued an urgent advisory for users to refrain from depositing additional NFTs into Flooring Protocol. Any newly deposited assets face significant risk while the vulnerability remains unpatched.
The protocol’s architect accepted full accountability for the contract architecture, noting that gas optimization techniques involving bit-level operations obscured the flaw from previous security audits.
This incident marks the second major security compromise for the protocol. An earlier breach resulted in approximately $1.5 million in NFT losses.
The development team is actively tracking extracted assets and maintaining communication with security professionals and cryptocurrency exchanges.
Get 3 Free Stock Ebooks
Discover top-performing stocks in AI, Crypto, and Technology with expert analysis.
- Top 10 AI Stocks - Leading AI companies
- Top 10 Crypto Stocks - Blockchain leaders
- Top 10 Tech Stocks - Tech giants
