Overview
- A Flooring Protocol vulnerability discovered on Monday let a tiny WETH deposit mint a near‑infinite balance of fpTokens, which attackers used to drain liquidity pools and redeem high‑value NFTs.
- Yuga Labs led a whitehat recovery on June 8 that moved 68 at‑risk NFTs into company custody, including 29 Bored Apes, CryptoPunks, Azuki, Doodles and Moonbirds, with the portfolio valued at more than $500,000.
- The rescue was funded by Yuga’s trading desk GrailsOTC and assisted by blockchain lead 0xQuit and security researcher Coffee, who said the rescue pulled assets out before further raids could occur.
- Yuga Labs and Flooring Protocol trace extracted assets while the protocol has warned users to stop new deposits; Flooring’s architect blamed gas‑saving bit‑level packing and indexing code that hid a ‘ghost ownership’ bug and caused an unchecked balance underflow.
- The incident highlights systemic risks in NFT‑fractionalization designs that peg fungible tokens to locked NFTs, raises concern over legacy contracts still holding assets after past breaches, and could prompt wider audits and changes to how NFT liquidity pools are built.