Ethereum NFT Launch Goes Sideways, Locks in $34M

A smart contract bug has left a highly-anticipated Ethereum NFT launch scrambling to survive.

 

Akutars, a 3D avatar project based on an original character (Aku) created by former Major League Baseball player Micah Johnson, was scheduled to launch last Friday. However, things didn’t go as planned as a flaw in the project’s smart contract locked away $34 million worth of Ethereum, meaning the creators cannot access the said funds.

 

The NFT project consists of 10,055 NFTs with randomly generated traits. Owners of the original Aku NFTs were given a free avatar for every piece they held. The remaining 5,500 collectibles in the collection were put up for sale via a Dutch Auction on Friday, with a starting price of 3.5 ETH, or around $10,350.

 

Following the launch, some members of the NFT community tried to draw the attention of the creators to the said exploit. One Twitter user named Hasan reportedly tried to warn the developers of an issue with the smart contract but was assured that fail-safes had been put in place to prevent its occurrence. According to a thread by Ethereum developer 0xInuarashi, another user named USER221 triggered the suspected flaw, halting withdrawals and refunds from the smart contract.

 

USER221 included a note in his transaction urging the developers to “please do bug bounty on [their] contracts or have them audited at least.” In another transaction, the user said they would eventually unlock the project.

 

“Well, this was fun, had no intention of actually exploiting this lol. Otherwise, I wouldn’t have used Coinbase. Once you guys publicly acknowledge that the exploit exists, I will remove the block immediately.”

 

Although the project began working again, another bug popped up, as explained by 0xInuarashi. Apparently, Aku developers coded the smart contract to allow bidders to receive a refund first before the team could make any withdrawals. The caveat was that a minimum number of bids had to be made before the team would be allowed to withdraw. This minimum number was set to be equal to the amount of NFTs available for auction, failing to account for multiple bids within the same transaction.

 

As expected, some buyers attempted to mint multiple NFTs within the same bid. This rather simple oversight meant that the terms of the smart contract were never fulfilled, resulting in locking away 11,539 ETH or about $34 million within the smart contract. Ultimately, Aku developers cannot withdraw any funds from the sale, and NFT owners who hold Akutar Mint Pass NFT cannot also receive the promised 0.5 ETH refunds.

 

In a postmortem Twitter thread on Friday night, the Aku team admitted that USER221 only tried to highlight the flawed smart contract, with no intent to cause harm.

 

Aku creator Micah Johnson also apologized for shrugging off other developers that first reported the issue. He tweeted:

 

“I completely own up to that. I’m unfortunately not a developer and spoke prematurely about what I understood wasn’t a problem but ended up being. I’m really really sorry.”

 

Looking ahead, the Aku team will issue the 0.5 ETH refunds to pass holders from funds taken from previous sales. Buyers will also be airdropped their Akutars NFTs through a new smart contract that has already been released to the public for review.

 

“The mistakes that were made are no more costly to anyone than myself. I’ve reinvested most everything into building Aku… Most everything will go back to refunds and we will keep building what we set out to do. Brick by brick.”