Gondi shuts down smart contract bug after $230K exploit


Alternative token platform Gondi said it disabled a faulty smart contract that allowed a hacker to steal $230,000 worth of NFTs from the protocol, adding that it is now in the process of compensating affected customers.

Gondi said in an X post on Monday that the hacker used the “Sell and Repay” contract, which allows borrowers to sell deposited NFTs and repay the loans automatically on the platform.

Gondi noted that an updated version of the contract was posted on February 20, but did not confirm how the hacker used it. No other part of the platform was affected by the exploit, Gondi said.

Data from Ethereum blockchain researcher Etherscan shows that 78 NFTs were stolen on Monday around 8:12 UTC. Blockchain security platform Blockaid estimated the damage at $230,000.

Source: blockade

In an update, Gondi said that its “focus is entirely on making amends to affected users” and that Blockaid and an independent auditor have since reviewed the platform and concluded that it is safe to use.

This includes repayment, renegotiation, refinancing of loans and initiation of new loans, in addition to buying, selling, trading and listing NFTs on the platform.

Gondi said it has not yet implemented an amendment to the now-defunct sales and payment agreement.

Crypto Samaritans Help Gondi Recover NFTs

While Blockaid said the hacker began selling some of the stolen NFTs, members of the NFT community were able to recover and return the NFTs Doodle, Aluminum Gazer, Lil Pudgy and the Muse servant, Gondi noted.

“We have active conversations about additional components and expect to follow suit, including taxpayers.”