Cross-Contract Ricochet Attacks & Off-Chain-On-Chain Manipulation of Billion Dollar NFT Collections
summary
Shows a concrete exploit chain: list for zero off-chain on marketplaces that don’t validate listings drives the advertised floor to zero, triggers panic selling and lets an attacker buy high‑cap NFTs back cheaply; demonstrates a nonce desync where off‑chain nonces differ from on‑chain checks so canceled orders remain executable unless users switch wallets; finds live contracts using raw 0x payloads that accept arbitrary function calls (including ERC‑721 buys) and several million‑dollar balances that can be drained; tests succeed against multiple marketplaces, some patched, some unresponsive.
AI-written summary · about
chapters (7)
- 0:00Introduction to NFT markets
- 3:31Technical and math challenges
- 6:21Marketplace floor price risks
- 10:55Off-chain and on-chain syncing
- 16:25Exploiting 0x library contracts
- 20:34The J-Pow attack vector
- 24:51Rug pulls and the future
related talks
43mOutsmarting Smart Contracts
51mA Deal with the Devil: Breaking Smart Contracts
21mBreaking Bridges - An Incomplete Sampler of Bridges Hacks
25mCommSec D2 - Smart Contract (In)Security
27mUnderhanded Solidity Contest Winner Presentations
18mNot Quite Water Under the Bridge
09mHow to Find Attackers and Improve Your Security Posture
26mAll your Ether belong to us (Hacking Ethereum-based DApps)