AkuDreams developers lock up $33M due to a smart contract vulnerability

Over 11,500 Ether (ETH) worth roughly $33 million was locked permanently under a smart contract, unreachable even to the development team, in the highly anticipated NFT project Akutars over the weekend due to both an exploit and a problem.

The exploit, on the other hand, was carried out by someone who wanted to expose a flaw in the project rather than steal money through a hack.

0xInuarashi, a creator of many NFT projects, revealed in a Saturday Twitter thread that Akutars’ smart contract was built so that reimbursements to bidders had to be processed first before the team could withdraw any funds.

https://t.co/A9lobVZC3p
34 Million USD gone. Just like that. Locked in the contract forever.

A lot of people put light on the grieving which locked processRefunds() for a bit, that was the first exploit.

Luckily that was unlocked, but funds are still locked forever. How?

🧵 1/

— 0xInuarashi (@0xInuarashi) April 23, 2022

The contract said that the team must submit a certain number of bids before being allowed to withdraw; however, the minimum number of bids was set to equal the number of NFTs available for auction.

Unfortunately, the conditions of the contract mean that the approximately $33 million in ETH will never unlock due to some bidders minting several NFTs in the same bid.

Developers reached out to the Akutars warning that their contract may be attacked, according to a now-deleted tweet shared by DeFi developer foobar, but they seemed to reject them completely, labeling the potential vulnerability a “feature.”

https://twitter.com/0xfoobar/status/1517662963892633601

Smart Contracts couldn’t process refunds

During the mint, an unidentified individual performed a “griefing contract,” which prevented the Akutars smart contract from processing refunds to underbidders.

Notably, as TheCoinRise reported, in March, Rare Bears faced a phishing attack which resulted in a loss of $800,000 in NFTs.

Akutars quickly responded by accepting responsibility for the code, claiming that the attack “was not done maliciously” and that the individual “intended to bring attention to best practices for highly visible projects.”

Micah Johnson, the project’s founder, and former pro-baseballer apologized to the community in a tweet the same day, saying that despite letting them down, he will “continue to build brick by brick” and strive tirelessly to avoid any future troubles.

Vulnerabilities have been pretty common in the crypto industry. Recently in February, a White-Hat hacker discovered a vulnerability in the Coinbase trading system.