Opensea Exploit Allows Bad Actors to Purchase NFTs at Lower Prices

Opensea is a Non-Fungible Token (NFT) marketplace where users can publish and trade their digital art, music, real estate, and digital experiences. The New York based platform was founded in 2017 by Devin Finzer and Alex Atallah. Using Ethereum, artists and creatives can mint and sell NFTs with smart contract capabilities that also allow them to earn residuals from future sales of their work.

What Happened?

On January 24th, 2022, numerous tweets from Bored Ape Yacht Club (BAYC) NFT owners expressed disbelief when they saw that they no longer had ownership of their digital Apes.

A video from Twitter user @0xHustler covers a number of BAYC NFTs that were repossessed at prices the original owners did not consent to.

The unofficial explanation for the ownership swap is an improper delisting between Opensea and another NFT platform named Rarible.

Here is a breakdown:

If a user no longer wishes to sell their NFT, the correct way to delist it is to do so on Ethereum network via payment of a gas fee.
If a user does not want to pay a gas fee, which can sometimes be very high due to structural and design issues with the network, they may transfer their NFT to a new ETH address. Opensea will then cancel the listing on their website front-end but the listing is not cancelled on the Ethereum blockchain.
If that NFT is sent back to the original address, then the Ethereum smart contract will still have the NFT listed for sale.
The discrepancy occurrs because Rarible only references the Ethereum blockchain while Opeansea is not removing the listing from the blockchain, only its own front-end.

What now?

After taking advantage of the exploit, the new Bored Ape owners instantly flipped the NFTs for the latest, higher asking price. In the first example below, we see that the bad actor purchased the NFT for 22.9 ETH and then relisted it on the open market for 135 ETH.

There were other examples of similar purchases and resales:

There is currently no official comment from Opensea on their website or Twitter account. However, some members in the community have taken on the task of reimbursing those affected.