Hey everyone,. You may have noticed the recent event in which three FelinE suddenly appeared out of the sky in an unusual ratio.
12 Jan 2023, 15:54
Hey everyone,
You may have noticed the recent event in which three FelinE suddenly appeared out of the sky in an unusual ratio. After being notified by our moderators, we immediately took action and investigated, only to find that a malicious attacker was attempting to brute force the block data in order to own three of our rarest kitties. We want to be as transparent as possible about this event, so here are a few key points:
- The attacker was using a middleman smart contract to continuously brute force the blockchain, waiting for the correct block attributes (block number, timestamp, difficulty, and block sender) to ensure that if they initiated the mint transaction, they would receive FelinE instead of any other catgirl. Not fair, since all catgirls are equally adorable!
- We immediately paused the MysteryBox smart contract and burned two out of the three FelinE cats to mitigate the damage. The attacker was able to pass one of the FelinE cats to the market, which was out of our control at that point.
What we've learned from this event:
- Never trust block data to provide fair randomness.
What's next:
- We're working on a solution to implement Chainlink VRF oracle to our smart contracts. This will ensure that no one can tamper with the random results, providing provably-fair and verifiable randomness. However, due to technical limitations, users will need to take an extra step to claim the mystery boxes after initially buying them. We'll reopen the mystery box feature once the new approach has been thoroughly tested.
Why didn't we use Chainlink initially? Why wait until now?
- Initially, we were considering both Chainlink VRF and blockdata approaches. However, as we aimed to have a gacha system that allowed users to pull boxes at a relatively low cost that is affordable to play, we decided to go with the blockdata approach in order to reduce the overall cost of minting while also providing a better user experience.
Doing things our own way instead of copying others comes with its own risks and requires trial and error. But we won't give up and will continue to bring unique and new experiences to the space. We're passionate about what we do and the potential of NFTs and blockchain. Thank you for reading this, and a big shoutout to our moderators and the community for always actively supporting us along the way.
Same news in other sources
112 Jan 2023, 15:54
Hey everyone,
You may have noticed the recent event in which three FelinE cats suddenly appeared out of the sky in an unusual ratio. After being notified by our moderators, we immediately took action and investigated, only to find that a malicious attacker was attempting to brute force the block data in order to own three of our rarest kitties. We want to be as transparent as possible about this event, so here are a few key points:
- The attacker was using a middleman smart contract to continuously brute force the blockchain, waiting for the correct block attributes (block number, timestamp, difficulty, and block sender) to ensure that if they initiated the mint transaction, they would receive FelinE instead of any other catgirl. Not fair, since all catgirls are equally adorable!
- We immediately paused the MysteryBox smart contract and burned two out of the three FelinE cats to mitigate the damage. The attacker was able to pass one of the FelinE cats to the market, which was out of our control at that point.
What we've learned from this event:
- Never trust block data to provide fair randomness.
What's next:
- We're working on a solution to implement Chainlink VRF oracle to our smart contracts. This will ensure that no one can tamper with the random results, providing provably-fair and verifiable randomness. However, due to technical limitations, users will need to take an extra step to claim the mystery boxes after initially buying them. We'll reopen the mystery box feature once the new approach has been thoroughly tested.
Why didn't we use Chainlink initially? Why wait until now?
- Initially, we were considering both Chainlink VRF and blockdata approaches. However, as we aimed to have a gacha system that allowed users to pull boxes at a relatively low cost that is affordable to play, we decided to go with the blockdata approach in order to reduce the overall cost of minting while also providing a better user experience.
Doing things our own way instead of copying others comes with its own risks and requires trial and error. But we won't give up and will continue to bring unique and new experiences to the space. We're passionate about what we do and the potential of NFTs and blockchain. Thank you for reading this, and a big shoutout to our moderators and the community for always actively supporting us along the way.
Hey everyone,.
Hey everyone,
You may have noticed the recent event in which three FelinE cats suddenly appeared out of the sky in an unusual ratio. After being notified by our moderators, we immediately took action and investigated, only to find that a malicious attacker was attempting to brute force the block data in order to own three of our rarest kitties. We want to be as transparent as possible about this event, so here are a few key points:
- The attacker was using a middleman smart contract to continuously brute force the blockchain, waiting for the correct block attributes (block number, timestamp, difficulty, and block sender) to ensure that if they initiated the mint transaction, they would receive FelinE instead of any other catgirl. Not fair, since all catgirls are equally adorable!
- We immediately paused the MysteryBox smart contract and burned two out of the three FelinE cats to mitigate the damage. The attacker was able to pass one of the FelinE cats to the market, which was out of our control at that point.
What we've learned from this event:
- Never trust block data to provide fair randomness.
What's next:
- We're working on a solution to implement Chainlink VRF oracle to our smart contracts. This will ensure that no one can tamper with the random results, providing provably-fair and verifiable randomness. However, due to technical limitations, users will need to take an extra step to claim the mystery boxes after initially buying them. We'll reopen the mystery box feature once the new approach has been thoroughly tested.
Why didn't we use Chainlink initially? Why wait until now?
- Initially, we were considering both Chainlink VRF and blockdata approaches. However, as we aimed to have a gacha system that allowed users to pull boxes at a relatively low cost that is affordable to play, we decided to go with the blockdata approach in order to reduce the overall cost of minting while also providing a better user experience.
Doing things our own way instead of copying others comes with its own risks and requires trial and error. But we won't give up and will continue to bring unique and new experiences to the space. We're passionate about what we do and the potential of NFTs and blockchain. Thank you for reading this, and a big shoutout to our moderators and the community for always actively supporting us along the way.