Incident Overview
The Friendsies NFT collection has been rug pulled by its founders, less than a year after raising $5 million at a Christie's auction on OpenSea, due to market volatility and challenges.
The founders of Friendsies announced on Twitter that they were pulling the rug on the project, blaming the current market conditions for preventing them from developing the project in a way they could be proud of. The project had been criticized by community members for deviating from its initial roadmap, with several aspects remaining undelivered, including a community treasury and a play-to-earn game. On-chain sleuth ZackXBT also revealed that the project's founders had not distributed 1.25% of all royalties to holders, as claimed in the project's official Discord server.
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Friendsies, these are the critical security checks that could have prevented this incident (February 2023).
- Verify all logic paths related to Rugpull are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSources & References
- 01
- 02
- 03
-
04
Web Archive https://archive.ph/jseQF
Learn to Prevent the Next Friendsies
The Friendsies hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.