Web3 in upheaval: a mysterious vulnerability in Open Source alarms the NFT world

by Liza Tanasova

2 years ago

Web3 has discovered a vulnerability in a widely used open source library that impacts the security of pre-built smart contracts, including several NFT collections, including those on the Coinbase platform. The announcement was made by Web3 development company Thirdweb, although minimal details of the vulnerability were provided, causing concern among users seeking further clarification to secure their contracts.

Thirdweb states that they discovered the vulnerability on November 20 and offered a fix two days later. However, they did not disclose the name of the library or the type and severity of the vulnerability to avoid alerting attackers. They claim that they have already contacted the maintainers of the vulnerable library and alerted other protocols and organizations, providing their findings and suggestions to fix the problem.

The vulnerability affects several types of smart contracts, including AirdropERC20, ERC721, ERC1155, BurnToClaimDropERC721, DropERC20, ERC721, ERC1155, DiscountCard, TradingPlatformV3, Multiwrap_OSRoyaltyFilter, OpenEditionERC721, Pack_OSRoyaltyFilter, TieredDrop, TokenERC20, ECRC721, ERC1155, SignatureDrop, NFTStake, EditionStake, and others.

Thirdweb recommends that smart contract owners take immediate mitigation action for all contracts created before November 22, 2023. The recommendation is to lock vulnerable contracts, take a snapshot, and then migrate it to a new contract created using an updated version of the library.

Users expressed their dissatisfaction with the lack of detail and transparency. One user requested the CVE vulnerability ID and a detailed explanation of the remediation process. Thirdweb offered retroactive gas grants to cover the cost of fixing the vulnerability, provided users provided the information.

The alert has also impacted valuable NFT holders, and major NFT trading platforms such as Coinbase and OpenSea have already taken steps to mitigate risks and secure user assets. OpenZeppelin, developers of another library for smart contracts, have also been informed of the problem and have indicated that it is not related to their library implementation.

Thus, the Web3 community is actively responding to the discovered vulnerability, taking steps to address it and ensure the security of smart contracts and user assets.

Other news

AIntuition Collection Set to Transform NFT Landscape with Real-World Benefits

The AIntuition Collection is set to launch, offering 15,000 NFTs that provide real-world utility and exclusive services.

Rajesh Kumar2 hours ago

Shiba Inu Shorts Liquidated in Dynamic Squeeze

Shiba Inu has experienced a significant rally, resulting in the liquidation of shorts worth $50,000 in just 24 hours.

Miguel Rodriguez3 hours ago

Generation Z Faces Severe Challenges in Home Affordability

Generation Z is facing severe challenges in affording housing, with many resorting to significant sacrifices. Reports indicate that potential homebuyers may need to earn $111,000 a year to afford a typical home in the US, which is $25,000 more than the median household income. To cope with these high costs, Gen Z is making drastic lifestyle changes, including selling their belongings, moving back in with their parents, and taking on side hustles.