Incident Overview
Deez Nutz Protocol exploited via flash loan attack, resulting in a loss of $174,086 USD worth 58.65 WETH.
On February 21, 2024, Deez Nutz, a protocol focused on NFTs, Tokenization, and DeFi, experienced an exploit due to a contract vulnerability and a flash loan attack. The attacker, identified as bigbrainchad.eth, targeted the erc404 series of tokens from DeezNutz_404 on Ethereum, causing an estimated total loss of around $170,000. The exploit involved a bug in the code that allowed the attacker to mint infinite tokens and steal approximately 58.65 ETH.
The root cause was an incorrect calculation when transferring tokens to self, which enabled the attacker to mint infinite tokens and sell them.The stolen funds still remaining attacker's address as of Feb 24,2024.
Attacker address:
https://etherscan.io/address/0xd215FFaf…af0Dfd
Funds Holder as of Feb 24, 2024:
https://etherscan.io/address/0xed65b99E…164c9A
Malicious transaction:
https://etherscan.io/tx/0xbeefd8fa…ec2d61
Malicious contract:
https://etherscan.io/address/0xd129D8C1…c84ecD
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to DeezNutz_404, these are the critical security checks that could have prevented this incident (February 2024).
- Verify all logic paths related to Flash Loan Attack are guarded by proper access controls and input validation - see the Flash Loans Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialRelated Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
- 01
-
02
Web Archive https://archive.ph/W6oOS
Learn to Prevent the Next DeezNutz_404
The DeezNutz_404 hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.