AkuDreams NFT Auction Seals $33 Million Due to Smart Contract Complication

The AkuDreams auction, an NFT initiative spearheaded by former Major League Baseball player Micah Johnson under his Akutars collection, ran into some trouble over the weekend after it was targeted by an exploit and a bug. While the exploit was merely done to expose the vulnerabilities of the project, the bug, on the other hand, has since caused 11,500 Ether (ETH) — amounting to around $33 million — to be locked within a smart contract.

Granted, the project just went live on Friday through a Dutch auction — where the price is lowered until a bid is received, and a sale is done as long as the bid remains above the reserve price. Refunds were also ensured for bidders who were underbid, under the smart contract. AkuDreams features 15,000 NFTs, but only 5,495 were made available during the auction which opened at 3.5 ETH. During the sale, “Aku Mint Pass” holders were also offered a 0.5 ETH discount on each minted NFT.

Twitter user 0xInuarashi, an NFT developer, pointed out that the way Akutars’ smart contract was coded restricted the development team from withdrawing any funds before refunds to bidders were processed. Additionally, there was a minimum number of bids that had to be made before the team would be allowed to withdraw but this was equal to the amount of NFTs available for auction.

The terms encoded in the smart contract entail that it will never unlock since buyers minted multiple tokens within the same bid. Hence, the approximately $33 million can no longer be recovered. DeFi developer foobar earlier cautioned the development team of this potential, but the warnings fell on deaf ears. “The AkuDreams team pretended that this was a feature, not an exploit, when multiple developers raised concerns prior to mint. Bizarre justifications,” explained foobar in a now-deleted tweet.

An anonymous individual executed a “griefing contract” — locking the ability of the Akutars contract to process refunds to those who underbid during the mint. “Well, this was fun, had no intention of actually exploiting this lol. Otherwise, I wouldn’t have used Coinbase. Once you guys publicly acknowledge that the exploit exists, I will remove the block immediately,” noted the individual in a message embedded on the blockchain.

“Quick Update (will go into more detail asap): 1. The exploit in the contract was not done out of malice; the person intended to bring attention to best practices for highly visible projects & novel mechanics. They unblocked the exploit quickly after we dug in and took ownership,” tweeted Akutars in response.

Following the mishap, Micah Johnson forwarded an apology to the community and assured them that pass holders will still be refunded 0.5 ETH while successful bidders will have their NFTs airdropped. “The mistakes that were made are no more costly to anyone than myself. I’ve reinvested most everything into building Aku. & most everything will go back to refunds and we will keep building what we set out to do. Brick by brick,” added the former pro baseball player. The minting contract has already been rewritten by the development team and audited by multiple developers.

Source: CoinTelegraph