What happened
FlippazOne was a single-NFT auction contract on Ethereum that anyone could empty. Its ownerWithdrawAllTo(address) function sent the contract's whole ETH balance to any address the caller chose. Unlike the other withdrawal paths, it had no owner check and no auction-end check. The auction started on July 5, 2022. Over the next day, bidders' ETH was drained twice, 5.15 ETH in total.
The first 1.15 ETH bid was taken by a Flashbots frontrunner. It copied a pending ownerWithdrawAllTo call and won a race in which one bot had paid 1,000 gwei. The next day a new 4 ETH bid, worth about $4,700 at the time, was withdrawn by an EOA 11 minutes after it arrived. The creator then ended the auction.
How it happened
- The creator
0x7f377ee93b2c7856838c9fb7effe0ba34399d9d3deployed the FlippazOne contract0xE85A08Cf316F695eBE7c13736C8Cc38a7Cc3e944and started the auction on July 5, 2022. A bidder,0x194a39f48f1d5e310d0e0cc25e727c7d2bff0b14, sent a 1.15 ETH bid. - At 19:30 UTC, bot
0x56d8...sentownerWithdrawAllToat 1,000 gwei (tx0x8bded20c1db5a1d5f595b15e682a95ce11d3c895d6031147fa49c4ffa5729a30). A generalized frontrunner copied the call and landed first in the same block through Flashbots. Its contract0xb314fd4ac6e10a7e27929cbc8db96743739c82b6received the 1.15 ETH in tx0x670da209fb1168941c4565a9a86f87d1011b24b857ea64f658b126a43f031fa0. - On July 6, another bidder sent 4 ETH. Eleven minutes later, EOA
0xD6EfC21d8c941AA06F90075dE1588ac7E912Fec6calledownerWithdrawAllToand received the 4 ETH in tx0xf2cc19d4c8bfb04e35789e9b716c5f1ba8b893df3a821b104ed5f845230a3762. - The creator called
endAuctionabout 80 minutes after the second drain.
Protocol details
Evidence
- transaction Etherscan transaction list, FlippazOne contract etherscan.io
- transaction Etherscan internal transactions, FlippazOne contract etherscan.io
- transaction Etherscan tx 0xf2cc19d4...3762 (4 ETH withdrawal) etherscan.io
- transaction etherscan.io transaction 0x670d…1fa0 etherscan.io
- address etherscan.io address 0x194a…0b14 etherscan.io
- address etherscan.io address 0x7f37…d9d3 etherscan.io
- address etherscan.io address 0xE85A…e944 etherscan.io
- address etherscan.io address 0xb314…82b6 etherscan.io
- analysis Robert Miller (Flashbots) thread on the FlippazOne drain (Thread Reader copy) threadreaderapp.com
- analysis DeFiHackLabs FlippazOne_exp.sol PoC raw.githubusercontent.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
