What happened
Boring Nakas (BNAKA) is an Ethereum NFT collection, not a fungible token: the verified contract is an ERC-721 with a public mint at 0.008 ETH per NFT. Mint payments stay in the contract and a single owner-only function, withdraw(), sends the whole balance to the caller. On 30 June 2023 at 18:38:59 UTC, about 20 hours after deployment, the owner address 0x57220b0f…B3867E called withdraw() and received 58.21 ETH, per the Etherscan transaction page for 0xbf655779…58c7fd.
De.Fi's REKT database lists the incident as a rug pull valued at 108,439 USD and says the funds were moved onward (transactions 0x9c7afadc…31cd15 and 0xd624ac15…81191a) and deposited into Coinbase. Cyvers' alert of 3 July 2023 reports the deployer boringnakas.eth removing 55 ETH (about 107K USD) and depositing it to Coinbase.
How it happened
- The collection is minted for ETH:
function mintSale(uint256 _amount) public payablerequiresprice * _amount <= msg.value, withprice = 0.008 ether, and the payments accumulate in the contract. - The owner has a withdraw function with no cap, delay, timelock or refund path:
function withdraw() external onlyOwner { (bool success, ) = msg.sender.call{value: address(this).balance}(""); require(success, "Transfer failed."); }. The ERC-721R base only randomises token ids; it contains no refund function. - The owner also controls the sale and price (
toggleSale(),setPrice(uint256 price_)) and can mint reserved ids to any address (reserve(address to, uint256 tokenId)). - What happened: the owner address called
withdraw()on 2023-06-30 and received 58.21 ETH (Etherscan transaction page). Cyvers reported the funds going to Coinbase.
Protocol details
Evidence
- report Cyvers Alerts tweet, 3 Jul 2023 (via fxtwitter) twitter.com
- transaction Etherscan transaction 0xbf655779a642be399584953921dc3d3f43fa3435191c287f3ab5fc1df458c7fd etherscan.io
- transaction etherscan.com transaction 0x9c7a…cd15 etherscan.com
- transaction etherscan.com transaction 0xbf65…c7fd etherscan.com
- transaction etherscan.com transaction 0xd624…191a etherscan.com
- address Etherscan verified source, BoringNakas (BNAKA) 0xf30a9cd4cd1fd9ea3270afcecde5fece34bc4aca etherscan.io
- address etherscan.com address 0x5722…867E etherscan.com
- analysis Sourcify repository copy, same contract repo.sourcify.dev
- analysis De.Fi REKT database listing for Boring Nakas (BNAKA) de.fi
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
