MutantNFTs Hack

The Lab from Mutants is an NFT staking platform that was exploited with a profit of about $25k USD.

The recent attack involved using stake keys from various users in a payment address controlled by the attacker, creating Franken addresses. This allowed the attacker to trick our Token Reward Claim validation and claim rewards belonging to other users. Our vulnerability was relying on a simple comparison of stake addresses to determine reward claim eligibility.

The attacker was limited to exploiting only eligible rewards and did not impact tokens in our Treasury wallet. The exact method used to obtain other users' reward information is unknown, but it's believed to involve examining addresses engaging with our Raffles/Stakes contracts and querying our API.

Exploited claims list was provided by Mutants team:

https://mutants-assets.fra1.cdn.digitaloceanspaces.com/others/spoof-attack-hashes.txt