In a funny turn of events, Rug Pull Finder (RPF), a watchdog for nonfungible tokens (NFTs) that looks for Web3-based fraud, has fallen victim to its own smart contract exploit.
According to a Sept. 2 post on Twitter by the NFT investigator, two people took advantage of a technical flaw in the project during the free mint stage and stole 450 of the possible 1,221 NFTs, which were only supposed to be given to one wallet at a time.
RPF says that their smart contract had a flaw in the code that was used by the bandits to give out more NFTs than were allowed.
Related: Research shows that diamonds are falling all over the Universe.
Soon after the exploit, the RPF team took steps to fix the problem. They made a deal with one of the people involved to pay them a bounty of 2.5 ether (ETH), which was worth $3,944.68 at the time this was written, to recover 330 of the NFTs. This deal was accepted.
The crypto investigators said that the exploiters “did negotiate in good faith and let us come up with a reasonable solution with them.”
The free mint, called “Bad Guys,” had artworks of NFT “scammers who got loose on the blockchain by accident.”
Before the fall 10,000 NFT collection, this collection is a “whitelist” or “pre-sale” for members.
Having a Bad Guy NFT gives you access to the mint, the RPF main drop, and other projects that are still in the works.
ignored the warnings
The watchdog group said that the exploit happened because they didn’t listen to warnings from an unknown source 30 minutes before the mint went live. The warnings were about possible flaws.
“After talking about it with three different development teams, we didn’t trust the information that was sent to us… We were wrong, and we are very, very sorry.”
The NFT investigator said that all the art and contract work was done by the digital blockchain creative agency Doxxed Media, and that they “did not have our team or an independent third party audit it.”
Related: The Federal Reserve has ended a decade-long enforcement action against HSBC.
The crypto community has noticed the irony of the exploit. Some have praised the NFT investigator for admitting its mistake, while others have asked how a company that specialises in finding weaknesses in smart contracts didn’t do the right checks on its own project.
But RPF has been able to get their NFT project back on track after a rocky start.
How do you decide on your next NFT? The community reacts
RPF talked to their online community and decided to put the recovered NFTs in different places, like the “Bad Guys Vault,” a raffle on Twitter, and two more raffles for projects that are friends of Rug Pull Finder and the Rug Pull Finder public sale wallet collection list.