Back to Markets
Crypto▲ Bullish
Yuga Labs Rescues 68 NFTs After Flooring Protocol Hack
Yuga Labs rescued 68 NFTs worth over $500,000 after a Flooring Protocol exploit allowed attackers to mint infinite fpTokens. The ghost ownership flaw bypassed audits, and the attack surface remains unresolved.
Continue with
Yuga Labs executed a whitehat rescue on June 8 after an exploit in Flooring Protocol put 68 high-value NFTs at risk. The company now holds 29 Bored Apes, 4 Mutant Apes, 1 BAKC, 2 CryptoPunks, 1 Azuki, 2 Elementals, 26 Captains, 1 Moonbird and 2 Doodles.
CEO Michael Figge said Yuga Labs acted after an exploit hit Flooring Protocol on June 8. Some collections had already been raided before the team found a related risk path. The rescue involved Yuga Labs' blockchain lead 0xQuit and security researcher Coffee. Figge said GrailsOTC fronted the funds and NFTs needed to move exposed assets away from vulnerable pools.
"We've just finished a whitehat operation on an exploit discovered in Flooring Protocol," Figge said.
Yuga Labs will work with Flooring Protocol developers to return the assets once a fix is ready.
Why Ghost Ownership Broke the Token Accounting
The Code-Level Exploit Mechanism
0xQuit said the exploit allowed a small amount of WETH to create a near-infinite fpToken balance. Attackers could then drain Flooring pools and redeem the underlying NFTs.
The issue came from packed ownership and indexing logic. According to 0xQuit, a malicious token ID could make ownership checks pass while later accounting showed a different result.
That created what he called "ghost ownership." After that, an unchecked balance update caused an underflow and gave the attacker a much larger balance than intended.
Once the balance wrapped, the attacker could push token prices near zero and extract liquidity from the pool.
Flooring Protocol's 0xFreeLunch said the exploit affected FloorProtocol V2 and BitmapPunks. Both projects used contracts where fungible tokens were pegged 1:1 to NFTs locked in the contract.
"Despite multiple rounds of security reviews," he said, an attacker found a vulnerability that allowed excess fungible tokens to be minted and redeemed for NFTs.
Key insight: The ghost ownership flaw meant a standard audit – which checks for correct logic paths – could pass even though the contract's core accounting was broken at the bit level.
Attack Surface Wider Than First Exploit
0xFreeLunch said the same vector also hit BitmapPunks and drained liquidity pools supplied by the team. He added that the attack surface was larger than the first attacker appeared to know.
The incident adds to Flooring Protocol's history of security concerns. Earlier related reports noted that the protocol was previously hit in an NFT exploit worth about $1.5 million.
Practical rule: When an exploit involves ghost ownership from packed-bit accounting, the contracts have no safe state until a full redeployment. Pausing deposits without redeploying does not fix the underflow vector.