What happened
WanderVerse was a 7,777-piece NFT collection on Ethereum (contract 0xA95d69F2…35E173) minted at 0.07 ETH. On 2022-03-08 the deployer address 0xB9542fc0…5D1ead called the contract's owner-only withdraw() in transaction 0x7cdb35a1…440414, moving 155.29 ETH (about $421.7K by Etherscan's price at the time) from the contract to itself. A second transaction De.Fi lists, 0x5b75f9bd…dfad79, is the same address unwrapping 6.16 WETH, not a call to the collection contract.
On 2022-03-10 PeckShield reported about 188 ETH from accounts linked to the project going to Tornado Cash and tagged it an NFT rug pull; De.Fi's listing records 484,887 USD lost and says the funds went into Tornado Cash (source: Bloxy list of transfers from 0xb9542fc0…5d1ead). Separately, ArkDev (HYTOPIA co-founder) alleged on X that the project had copied content from another game to look legitimate.
How it happened
- The deployer deployed
WanderVerseas anOwnableERC-721 collection. The constructor sets only the name and symbol (ERC721("WanderVerse", "WV")); the owner is the deploying address. - The owner opens the sale with
flipSaleActiveState(), and anyone can then callmint(uint256 amount)withmsg.value == amount * price, whereprice = 0.07 etherby default. Every mint payment stays in the contract balance. - Nothing in the contract limits what happens to that balance:
function withdraw() external onlyOwner { payable(owner()).transfer(address(this).balance); }sends the whole balance to the owner in one call, at any time, with no vesting, cap or minimum mint requirement. - On 2022-03-08, the deployer address called
withdraw()and Etherscan shows 155.29 ETH moving from the collection contract to that address (tx 0x7cdb35a1…440414). - PeckShield reported on 2022-03-10 that about 188 ETH linked to the project was sent to Tornado Cash; De.Fi describes the funds as deposited into the mixer.
Protocol details
Evidence
- report ArkDev post on X about WanderVerseNFT twitter.com
- report PeckShieldAlert post on X, 2022-03-10 twitter.com
- report WanderVerse source on Sourcify (chain 1) repo.sourcify.dev
- transaction Etherscan transaction 0x7cdb35a1...440414 (withdraw()) etherscan.io
- transaction Etherscan transaction 0x5b75f9bd...adfad79 (WETH withdraw) etherscan.io
- address WanderVerse verified source (Etherscan code tab, contracts/WanderVerse.sol) etherscan.io
- analysis bloxy.info page 0xb954…1ead bloxy.info
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
