CryptoMochi (peacewise)

I owe everyone a proper technical breakdown of the exploit of PaymentProcessorV2 and the rescue that followed. The short version: Payment Processor trusted an ERC-2771 style “original sender” supplied through a trusted forwarder. That sender could be forged. 1/🧵

Well it looks like 0x4B04...98e1 is on our side. They just sent their remaining NFTs to the safu wallet. - 378 @10KTFshop Grailed - 391 @ThePlagueNFT - 556 @_HenHouseNFT - 118 @WilderWorld - 1 @beeple everyday Any donations submitted for these will go to 0x4B04.

0x28BC...27Ad who rescued ~150k lower value NFTs across ETH, Base, and Polygon has just agreed to participate in the return after a day of back and forth. They've delegated their wallets and the assets are added to nftsaresafu.xyz (RIP our progress bar). Donations routed to them. Note that in this case, they've issued a 7702 delegation to a contract I deployed for them to enable the rescue. They can revoke that delegation at any point, so I can't guarantee these assets are available forever. If they do revoke or change their 7702 delegate address, the site will cease to display those NFTs.

At 9AM EST today somebody abused a bug in Payment Processor V2 to steal 10 Meebits, 50 Otherdeeds, 10 WoW, and 235 Desperate Apewives. It wasn't until over 12 hours later that somebody reported it to me, and upon digging in I realized that a great many NFTs were subject to the same exploit. I got in touch with the team over at LimitBreak and they quickly paused Payment Processor V3, which was subject to the same exploit. Unfortunately, V2 was not pausable, so the only path towards protecting affected assets was to run a whitehat operation. Similarly, V3 on ApeChain is temporarily in a state where it cannot be paused, so ApeChain assets approved to V3 needed to be saved as well. All in all, we rescued 23,155 NFTs worth north of $5.7M USD. We later discovered that a similar exploit could be used in reverse to steal WETH. 660 WETH was at risk, which we unfortunately were not fast enough to recover. Apologies to those affected. Shout out to @Boomskite for flagging the initial exploit tx to me, and @coffeedev @0xjustadev and @whiteoakkong for acting quickly and assisting with the recovery. All NFTs are safely relocated. Soon, owners will be able claim them back after revoking the exploitable approvals. Addresses to revoke below.

A user won a CryptoPunk off a 0.06E spin on FWA today (fun story on that at the end). You may have seen some chatter about the protocol on the timeline. I’ve been having fun with it and find the mechanic pretty cool, so here’s a quick breakdown of how it actually works. 1/🧵