Yuga Labs Rescues $570K in NFTs From Floor Protocol Exploit
In brief
- Yuga Labs rescued ~$570K in NFTs from Floor Protocol exploit affecting Bored Ape collection and others.
- Recovery included 29 Bored Apes, 2 CryptoPunks, and dozens of additional NFTs from vulnerable pools.
- Exploit enabled attackers to convert wrapped Ethereum into infinite token balances to drain pools.
- Yuga Labs holds assets in custody while coordinating with Floor Protocol developers on return.
The Exploit and Response
The exploit allowed attackers to convert a small portion of wrapped Ethereum (wETH) into a nearly infinite μToken balance to drain NFT pools. Yuga Labs discovered the vulnerability could be extended to other significant collections beyond the initial attack. The team moved quickly to secure exposed assets before other malicious actors could exploit the same paths.
0xQuit, VP of Blockchain at Yuga Labs, described the urgency: "The goal was to remove exposed NFTs from vulnerable Flooring pools before another malicious actor could exploit the same paths and extract them first."
Floor Protocol and Asset Recovery
Floor Protocol, which sunset its operations last year, allowed users to gain liquidity for their NFTs by depositing them into pools and earning fungible μTokens. The protocol's dormant state left certain pools vulnerable to the discovered attack vector. Bored Apes still hold a floor price of more than $15,000, while CryptoPunks trade for a minimum of around $55,000, making the rescued assets significant in value.
Yuga Labs CEO Michael Figge emphasized the impact of the rescue: "Thanks to this move, we were able to save dozens of assets from impacting the market and Flooring protocol tokens from being compromised."
