What happened
On December 17, 2023 (UTC), an attacker used a flaw in Flooring Protocol, an NFT liquidity protocol on Ethereum, to take 36 Pudgy Penguins and 15 Bored Apes from users who had approved the protocol to move their NFTs. The haul was worth about 690 ETH (roughly $1.54 million), and the attacker sold the NFTs on Blur for about $1.5 to $1.6 million.
Flooring said the bug was in its peripheral/multicall contract, deployed a fix within about two hours, and said assets held in its vaults and safeboxes were not affected. The researcher foobar flagged the thefts on-chain and linked them to a contract upgrade made several days earlier; Protos noted that Flooring's published audits predated that upgrade. Boring Security warned that victims might not get their NFTs back because the attacker had already sold them.
How it happened
- Users had granted the Flooring contract (proxy
0x49AD262C49C7aA708Cc2DF262eD53B64A17Dd5EE) operator approval over their NFT collections. - A recent upgrade exposed
extMulticall, which forwarded caller-supplied(target, callData)pairs to any contract with Flooring asmsg.sender, without restricting targets or checking who owned the assets. - The attacker, from
0x4d0d746e0f66bf825418e6b3def1a46ec3c0b847through contract0x7e5433f02f4bf07c4f2a2d341c450e07d7531428, built calls ofsafeTransferFrom(victim, attacker, tokenId)on the NFT contracts and passed them toextMulticall. - Because the NFT contracts saw an approved operator, they moved the tokens. One transaction alone took 36 Pudgy Penguins from a single wallet.
- The attacker sold the stolen Bored Apes and Pudgy Penguins on Blur.
Protocol details
Evidence
- report foobar on X: looks like yet another exploit in the wild x.com
- transaction Etherscan transaction 0xec8f6d8e...27b40 etherscan.io
- code DeFiHackLabs FloorProtocol_exp.sol github.com
- analysis DeFiLlama defillama.com
- analysis Flooring Protocol hacked: Pudgy Penguin, Bored Ape NFTs gone crypto.news
- analysis Floor Protocol exploited, Bored Apes and Pudgy Penguins gone protos.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
