A vulnerability in the OpenSea interface allowed an attacker to obtain 347 ETH – Bits Media

Cybersecurity agency PeckShield has identified a critical vulnerability in the interface of the NFT issuing and trading platform OpenSea, allowing you to purchase tokens at greatly reduced prices.

Real-time alert bot PekShieldAlert from the agency cybersecurity PeckShield reveals a critical vulnerability in the OpenSea interface. A user under the pseudonym jpegdegenlove was caught using the vulnerability.. Currently, the attacker was able to obtain 347 ETH for an amount over $750 000.

Twitter user VirtualToast.eth reported, that his NFT Bored Ape #8924 was purchased for 6.66 ETH – roughly at 92% less than the current minimum price. According to the user, he previously planned to sell Bored Ape #8924 at this price, but then decided to cancel the auction and sent the NFT to another wallet.

but, despite , that NFT was excluded from the marketplace sales list, in fact, the sales order was reflected as active according to the OS API. This allowed the attacker to buy Bored Ape #8924 at the old price. Twitter user The Autist Wizard says, that the criminal deliberately chose the owners of NFT Bored Ape as targets of the attack.

This is not the first complaint, sent by users to the OpenSea marketplace. Fraud using insider information was previously detected, which allowed an OpenSea employee to buy the most promising NFTs before they were published publicly.