Meebit NFT Exploit Analysis

It was the year 1964 when a young economist, Stefan Mandel, won 72,783 leu from a Romanian state lottery. There are many similar stores where a really lucky player got a once in a lifetime win only to be never heard from again. Except, Stefan went on to win a total of 14 lotteries in his lifetime including the $27 million Virginia state lottery in 1992. He did it by finding weaknesses in lotteries around the world which allowed him to all but guarantee a win. Modern lotteries have instituted new rules and increased the number of combinations to stop the likes of Stefan Mandel. However, the brave new world of DeFi introduced new opportunities for enterprising folks to try and successfully beat the odds again.

In this blog post, I will dive into one such DeFi lottery heist where a player won a very rare and valuable Meebit NFT which they sold for 200 ETH (~$700,000 at the time). You will learn technical details about the hack, explore the attack timeline, and learn how to replicate it in yourself.

Meebits

It all started on May 3, 2021 when Larva Labs announced their latest NFT project called Meebits, a collection of 3D avatars designed for virtual worlds and games. In order to reward their early investors, Larva Labs allowed anyone holding their other NFT projects, Cryptopunk or Autoglyph, to redeem them for a single free Meebit. The process…