1. Introduction to Xcarnival
NFT How does lending work? ’s NFT lending-enabled platform allows holders to borrow funds and set terms without an intermediary. Borrowers can expect to obtain a loan amount of approximately 50% of the NFT value, with interest rates ranging from 20% to 80%, depending on the popularity of the NFT.
The beauty of DeFi protocols is that they are simple, transparent and efficient compared to traditional lending institutions. The asset used as collateral by the NFT is sent to a secure smart contract, which acts as an unbiased, automated third-party program to complete the entire lending process.
Lenders assess the fair value of collateral, typically by looking at the asset’s past performance, sales history, or similar NFT floor prices. Once both parties agree on terms, the NFT is transferred from the borrower’s wallet to an escrow account, and a smart contract facilitates the loan.
2. XCarnival was attacked, and 3,087 ETH were stolen.
On June 26, it was reported that the NFT lending agreement XCarnival was attacked, and the hacker made a profit of 3,087 Ethereum (about 3.8 million U.S. dollars), while the loss to the protocol may be higher.
/0xb38707e31c813f832ef71c70731ed80b45b85b2d
Hacker address:
https:// /eth.tokenview.com/cn/address/0xb7cbb4d43f1e08327a90b32a8417688c9d0b800a
https://eth.tokenview.com/cn/address/0xca67615bb9a9cc093e13dee3de1ca55b55ab3586
3. XCarnival stolen Through
Tokenview, I will take you through the whole process of XCarnival being attacked:
1 attacker
https:// eth.tokenview.com/cn/address/0xb7cbb4d43f1e08327a90b32a8417688c9d0b800a took out 120ETH from Tornado.Cash as "attack preparation".
2 Then spent 91.65ETH on Opensea through the opensea seaport protocol to purchase NFT BAYC #5110.
3 creates multiple attack contracts and implements the attack process by transferring BAYC NFT. Taking contract address 0xf7 as an example, the first attack used contract 0xf7 to mortgage NFT multiple times, earning a total profit of 1980 ETH.
0xf70F691D30ce23786cfb3a1522CFD76D159AcA8d
0xbcf759e6889af3af5cdb02ddc5557aa525e7ed8b
0x3edf976df38f7 d6273884b4066e3689ef547d816
0x7b5a2f7cd1cc4eef1a75d473e121 0509c55265d8
0x234e4b5fec50646d1d4868331f29368fa9286238
4 This attack exploited a contract bug in the NFT lending platform: NFTs that have been uncollateralized are still used as collateral. In other words, after the collateral NFT is taken out, its orderID can still be used and you can also apply for a loan. According to Tokenview data, the attacker made a profit of at least 3,000 ETH (about 3.8 million U.S. dollars).
5 In the end, the attacker sold the NFT BAYC5110 on Opensea for 85ETH, and finally got back 81.56ETH.
4. XCarnival official response
At 22:07 on June 26, the XCarnival team tweeted that it had suspended smart contracts, deposits, and borrowing functions.
and at 22:37:19, XCarnival started a conversation with the hacker. The content of the conversation is: "Hello, we have become aware of the loopholes in our contract, and we are contacting you in the hope of recovering this loss. I would be very grateful if you would talk to me. We can communicate or trade at [email protected] , thank you. "
Until 1 a.m. on June 27, XCarnival attackers began to transfer assets one after another. According to data on the Tokenview chain, at 01:12:29, the attacker sent 2,967 ETH (approximately $3.6 million) to the new address 0xca.And from 01:17:02 to 01:22:22, 120 ETH will be sent to Tornado.cash in batches.
According to data on the Tokenview chain, after a series of dialogues and negotiations, XCarnival stated that (on the premise that the attacker returned the stolen funds) it would give the attacker (0xb7CBB4d43F1e08327A90B32A8417688C9D0B800a) a bounty of 1,500 ETH, and clearly exempted this person from the bounty. Legal action.
attacker message: "Glad to hear this - funds will be refunded - please issue an official statement - signed by xCarnival CEO - giving oxb7 (attacker address) owner the 1500ETH bounty and Proceedings expressly denied.” Then the XCarnival team posted this tweet.
At 13:45:58, the attacker returned 1,467 ETH to XCarnival (0xc087629431256745e6e3d87b3ec14e8b42d47e48). The specific transaction path is to transfer from the address of 0xca back to the address of 0xb7, and finally to the wallet address 0xc08 officially provided by XCarnival. After the XCarnival attacker returned 1,467 ETH,
0xfc5724c285213269cc53d6156e8d2fddbbcad626 initiated a conversation with the address
0xfc5724c285213269cc53d6156e8d2fddbbcad626 and wrote, "Sir, I appreciate your action but I want to apply as a mediator to ensure the security of the transaction. and effective." The attacker has not yet responded.
Tokenview will continue to pay attention to the dynamics on the XCarnival attacker chain and bring the most comprehensive data analysis.
