What happened
On March 3, 2022 (UTC), attackers bought listed NFTs on Treasure Marketplace, the MAGIC-denominated NFT marketplace on Arbitrum, for zero MAGIC. PeckShield counted more than 100 NFTs taken from several collections over a series of transactions. Smol Brains were the main target; one gold Smol Brain was listed at about $560,000.
The marketplace handled ERC-721 and ERC-1155 listings in the same buyItem path. The buyer passed a _quantity, and the price was _pricePerItem * _quantity. Nothing required the quantity to be non-zero, and for ERC-721 listings the contract transferred the NFT without regard to the quantity. A quantity of 0 therefore made the price 0 while the NFT still moved to the buyer.
Co-founder John Patten told users to delist their items and pledged to cover losses, including with his own Smols. The Marketplace and Bridgeworld were taken offline. By March 4, Treasure reported that 134 of 154 stolen NFTs had been returned, and it planned a peer review group and bug bounty before relaunching. The current contract rejects a zero quantity and requires exactly 1 for ERC-721 purchases.
One exploiter address: 0x9b1acd4336ebf7656f49224d14a892566fd48e68
Example transaction: 0x37222d3ad371dff2d3f3ae1c788d1cc4ad69e9f1839776830726485119a89269
How it happened
- Find an ERC-721 listing on Treasure Marketplace, for example a Smol Brain priced in MAGIC.
- Call
buyItemon the marketplace buyer contract0x812c...e273with the correct NFT address, token ID and seller, but_quantity = 0. - The contract computes the total price as
_pricePerItem * _quantity= 0, so it pulls 0 MAGIC from the buyer and pays 0 MAGIC to the seller. - Because the listing is ERC-721, the contract calls
safeTransferFromfor the token ID without checking the quantity, and the NFT moves to the buyer. - Repeat across listings. Arbiscan shows exploiter
0x9b1a...8e68taking Smol Brain #5490 and #2227 this way at 00:43 and 00:47 UTC on March 3.
Protocol details
Evidence
- report Treasure (@Treasure_DAO): Marketplace and Bridgeworld offline; 134/154 stolen NFTs returned twitter.com
- report PeckShield thread on the Treasure Marketplace exploit twitter.com
- transaction Arbiscan tx 0x37222d3a...9269 arbiscan.io
- transaction Arbiscan tx 0x57dc8e6a...2a2b arbiscan.io
- address arbiscan.io address 0x9b1a…8e68 arbiscan.io
- code TreasureMarketplace.sol (current master) github.com
- analysis Beosin's Analysis of the Arbitrum-based TreasureDAO exploit (TechBullion) techbullion.com
- analysis Bug in Treasure NFT marketplace results in listings being sold for 0 (Web3 is Going Just Great) web3isgoinggreat.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
