Digital Asset
Intelligence
Security Incident · Exchange

Flooring Protocol & BitmapPunks Smart Contract Vulnerability

·Historical incident record

Incident Overview

Flooring Protocol V2 and BitmapPunks (BT404 / $BMP) were exploited due to a BT404-style packed ownership logic vulnerability (malicious high-bit token ID alias + unchecked integer underflow). The attacker minted near-infinite fpTokens/$BMP with a dust amount of WETH, drained liquidity pools, and extracted high-value NFTs (e.g., BAYC, CryptoPunks) at low cost. Yuga Labs quickly intervened with a white-hat operation via GrailsOTC, rescuing 68 NFTs worth over $500,000, now held safely for return after fixes.

Sources & References

Original incident referencehttps://x.com/mfigge/status/2063782936399544740 (opens in a new tab)

This record presents information attributed to the linked sources. Incident dates describe the original event, not a new report. Reported loss figures reflect the source record and are not current market valuations.

More Security Incidents

View All →
  1. Incident date
    Attack methodSupply Chain Attack
    Reported loss$ 62,900
  2. Incident date
    Attack methodMalicious Governance Takeover
    Reported loss$ 1,580,000
  3. Incident date
    Target

    Fluid

    Attack methodPrivate Key Leakage
    Reported loss$ 215,000
  4. Incident date
    Target

    mySwap CL

    Attack methodSmart Contract Vulnerability
    Reported loss$ 300,000
  5. Incident date
    Attack methodSmart Contract Vulnerability
    Reported loss$ 110,600