SUPERrare NFT Marketplace Exploited: $731,000 in RARE Tokens Drained
The NFT marketplace SuperRare has fallen victim to an exploit, resulting in the loss of 11.9 million RARE tokens, valued at approximately $731,000. Fortunately, the vulnerability did not compromise the underlying $RARE token contract or its core functionalities, limiting the damage to the RareStakingV1 contract, which is part of SuperRare’s staking and curation initiative launched in August 2023.
The Exploit: A Faulty Permission Check
According to Web3 security firm Blockaid and threat intelligence platform MistEye, the exploit stemmed from a flawed permission check in the “updateMerkleRoot” function within the RareStakingV1 contract. This function was designed to restrict updates to the Merkle Root, which verifies staking and rewards claims. However, the code failed to enforce this, allowing anyone to modify the Merkle Root and claim tokens. As a result, any address could pass verification and make unauthorized claims.
A Two-Step Exploit
The exploit unfolded in two steps: first, the attacker deployed an exploit contract. Before the attacker could execute their exploit, another address observed the pending transaction and front-ran it in the following block, successfully draining the funds. Cyvers confirmed this front-running event and traced the original attacker’s funding to Tornado Cash about 186 days earlier. Further research revealed that the attacker might be “an active DeFi farmer,” as the address has interacted with several platforms, including Pendle, Uniswap, Odos, Reservoir, and Morpho.
Impact and Aftermath
The stolen funds remain in the attacker’s contract and have not been moved or laundered through exchanges or mixing services. SuperRare has not released a post-mortem or detailed remediation plan, leaving the community to wonder about the next steps. This exploit comes as the NFT sector begins to show signs of resurgence, with the market adding over $1 billion in value in just 24 hours and trading volumes soaring 287% to $37.4 million.
NFT Market Resurgence
This resurgence is closely tied to Ethereum’s ongoing rally, with ETH gaining 55% over the past month and momentarily hitting $3,814, its highest price since December 2024. As a result, buyer interest has increased, and floor prices across top collections have risen. CryptoPunks and Pudgy Penguins have emerged as frontrunners in this recovery, with CryptoPunks seeing a 16% rise in floor price to 47.5 ETH (approximately $179,000) and generating $14 million in sales over 24 hours.
The NFT market’s recovery is a welcome change after a long market slump, but the SuperRare exploit serves as a reminder of the importance of security and vigilance in the Web3 space. As the market continues to evolve, it’s crucial for platforms and users to prioritize security and stay informed about potential vulnerabilities and exploits.
