OpenSea is implementing measures to curb a recent attack method that exploits the marketplace’s user interface flaws.
According to Elliptic, a UI issue on OpenSea recently saw over $1 million worth of NFTs bought for very little and then resold for a higher price. At least three people exploited this issue and purchased eight NFTs at a significantly discounted price.
The security breach occurred when the perpetrators relisted an NFT at a new price without canceling the earlier listing. The price of the earlier listing was the price paid by the attackers, which was below the current prices. An OpenSea spokesperson said that the company is “actively reaching out to and reimbursing affected users.” They admitted that the user interface was “confusing,” which saw multiple users’ NFTs sell below their market value.
One Twitter user’s NFT sold for $1,800, 99% below the floor price. The buyer took advantage of this and sold it for nearly $200,000, making a profit of $198,200.
OpenSea did not publicize UI issue
OpenSea has always used this user interface. But it recently caught hackers’ attention. OpenSea did not want the possibility of criminals becoming aware of the issue, so they didn’t highlight it initially. They wanted first to mitigate what they believed was “not an exploit or a bug- it’s an issue that arises because of the nature of the blockchain,” the spokesperson said. They added that user must cancel their own listing.
OpenSea takes the attack “incredibly seriously”
OpenSea takes the problem “incredibly seriously”, they are working on improvements. One of them is a new listings manager which presents users with seeing their ads and optionally canceling them. Now, the duration of a listing will be one month instead of six months, so if an NFT is returned to a wallet after six months, the listing will have expired.
When users transfer one NFT with an active listing out of their wallet, they ask them if they want to cancel it. OpenSea will also send the user an email if they have registered on OpenSea with it.
Canceling a sell offer requires an on-chain transaction, which many sellers want to avoid due to the high gas fees on Ethereum. Thus, OpenSea users choose to move their NFTs to another wallet.
