March 21, 2022

OpenSea In Trouble: Exploit Causes People to Lose Millions, Company Pays Back

by Sebastian Calderon
OpenSea

Community Update

 

OpenSea recently sent an email to users who had inactive NFT listings on their accounts. The email instructed users to manually cancel their old or inactive NFTs as OpenSea couldn’t do that on their behalf indicating that they were still fulfillable.

According to the email, it was important to do so to stop “items from being sold at the inactive listing price,” due to the sudden drop in Ether’s market value. What looked like a goodwill gesture turned out to be troublesome for OpenSea as canceling listings resulted in the recreation of the order, according to several members who shared their troubles on social media.
Thread
An OpenSea user, who goes by the name @swolfchan on Twitter, shared the news warning people to be careful. “So I got two emails today from @opensea about listings, and lost 15 ETH+ from exactly what they’re trying to prevent…(sic),” said the post.
“I was told to please act urgently to cancel any inactive listings…canceled a 15 ETH MAYC @BoredApeYC and it triggered a 6 ETH listing… and sold??,” he added.
He wasn’t the only one who faced a similar fate. Another Twitter user, Dingalingts, shared how “canceling the listing ended up recreating the order.” He requested users to “FIRST transfer your NFT to a different address and cancel the listing/s on the original address BEFORE” canceling them.

Images5

Why Did This Happen?

It is believed that it happened due to a bug. The company discovered that the information was misused to exploit OpenSea users. According to experts, this isn’t a new exploit. It is believed that inactive listings pose a major risk, whereas expired listings are acceptable.
Users are required to pay a gas fee on the Ethereum blockchain if they wish to cancel a listing. This fee can run into thousands. Some users found a loophole to avoid this fee, which resulted in the mishap. They figured that transferring their digital asset to another wallet and then sending it back to the original wallet would cause the listing to vanish on the platform. However, the NFT didn’t expire, it only went inactive and users could still purchase inactive NFTs.
“Fixing this issue is our #1 company priority. We have a team working on it and putting up a countermeasure now,” said Alex Atallah, OpenSea co-founder, while talking to Dingaling.

image4

While the company is yet to find a permanent solution to the problem, it was quick to correct the issue. It has reimbursed over $1. million to users who lost money due to the exploit.

OpenSea Reimburses Users in Ethereum

OpenSea has made some changes to the platform. Users will now see a “Listings” tab on their profiles where they can review both inactive and active listings. The company has so far reimbursed 750 Ethereum, worth $1.8 million, to users who suffered losses due to the exploit.
Contact the company (https://opensea.io/) if you are a victim and haven’t been reimbursed yet.

Share On:

Leave a Reply

Your email address will not be published. Required fields are marked *