Meebit NFT Exploit Analysis
--
It was the year 1964 when a young economist, Stefan Mandel, won 72,783 leu from a Romanian state lottery. There are many similar stores where a really lucky player got a once in a lifetime win only to be never heard from again. Except, Stefan went on to win a total of 14 lotteries in his lifetime including the $27 million Virginia state lottery in 1992. He did it by finding weaknesses in lotteries around the world which allowed him to all but guarantee a win. Modern lotteries have instituted new rules and increased the number of combinations to stop the likes of Stefan Mandel. However, the brave new world of DeFi introduced new opportunities for enterprising folks to try and successfully beat the odds again.
In this blog post, I will dive into one such DeFi lottery heist where a player won a very rare and valuable Meebit NFT which they sold for 200 ETH (~$700,000 at the time). You will learn technical details about the hack, explore the attack timeline, and learn how to replicate it in yourself.
Meebits
It all started on May 3, 2021 when Larva Labs announced their latest NFT project called Meebits, a collection of 3D avatars designed for virtual worlds and games. In order to reward their early investors, Larva Labs allowed anyone holding their other NFT projects, Cryptopunk or Autoglyph, to redeem them for a single free Meebit. The process was called a “community grant” which was open for only 7 days.
Below is the code snippet from the Meebit smart contract which implements the giveaway logic:
The mintWithPunkOrGlyph function above takes a Cryptopunk or an Autoglyph ID and returns a newly minted Meebit. Only 20,000 Meebits can ever be minted each with different attributes of varying rarity. Below is a sample transaction log which illustrates a single Meebit #4563 getting minted using Cryptopunk #3341:
