TreasureDAO hack — March 2022

On 3 March 2022 an attacker took NFTs from Treasure's marketplace on Arbitrum without paying for them. The TreasureMarketplace contract calculated a purchase total as the price per item multiplied by a caller-supplied quantity, and validated only that the listing held at least the requested quantity. Passing a quantity of zero satisfied that check, produced a total price of zero, and still executed the NFT transfer. CertiK, which published a post-mortem the same day, said the fix was to require the quantity to be greater than zero. Fairyproof's independent code analysis reached the same conclusion, noting the function checked listed quantity where it should have checked that the amount paid met the listing price. PeckShield traced the defect to the contract mispricing an ERC-721 as an ERC-1155 with an untrusted zero quantity.

Contemporaneous reporting put the count at more than 100 NFTs, mostly from the Smol Brains and Legions collections. The widely repeated figure of roughly 426,500 MAGIC, about $1.4 million, is narrower than it appears: PeckShield's count, as relayed by CryptoPotato, applies to 17 Smol Brains NFTs taken by a single attacker address. CoinDesk separately valued the stolen Smol Brains at over $1.4 million at the time of the attack. No published source gives a verified total across all 100-plus NFTs and all taker addresses, so $1.4 million should be read as a floor for a partially documented loss rather than a settled total.

Treasure froze the marketplace. Community members traced the taker addresses publicly and NFTs began being returned within hours. Co-founder John Patten said the project would cover the cost of the exploit and offered his own Smol Brains holdings toward it, and the DAO said users who did not get their NFTs back would be made whole under a community vote. MAGIC fell about 40% before recovering to around $3.34.