With the surge in blockchain tech over the last few years, we have seen a surge in malicious users trying to drain funds from the system.
OpenSea is one of the leading NFT marketplaces on the web, seeing USD $2B in volume in the last 30 days. Home to some of the most popular collections in the NFT space, users flock to the site to get their hands on BAYC, Cool Cats and more.
Rug, the owner and operator of Rug.Tech and their team uncovered a potential market toppling OPENSEA bug. The response from OpenSea was less than ideal.
Finding bugs is often lucrative, especially in blockchain. Companies are willing to pay millions for discovery of mission critical bugs. Opensea however pays next to nothing for discovering potentially platform ending errors in their codebase. (Thread)https://t.co/WJV3DIQIae
— fuckingrug.eth ?? (@FUCKINGRUG) November 7, 2021
In an interview with Altcoin Buzz, Rug says “Typical blockchain bounties of this magnitude topple into the millions quickly”
With no agreements signed with OpenSea, Rug shared information about the bug and OpenSea’s offer to them.
A bad actor could have easily used this knowledge to mint fake blue chip NFTs, seemingly created by verified wallets. This would have caused a frenzy buy to get in on the new project “dropped” by the creator.
— fuckingrug.eth ?? (@FUCKINGRUG) November 7, 2021
Rug tells us, “For example, I could launch a fake Bored Apes project from their official OS account”. A potentially market crippling bug that could trick users into spending millions on fake collections.
And how much did OpenSea offer Rug and his team that found a bug that could have potentially saved OS hundred of millions of dollars?
3ETH or ~USD 15K.
This was the first time Rug dealt with OpenSea in this capacity. And it will be the last.
“To be honest, if the bug wasn’t this horrible we would have said fuck em. But this could have toppled the market entirely”, Rug said. “They offered ‘more than 3 ETH’ when I pressed but took the offer back after we helped patch the bug”.
The bug Rug and the team behind Rug.Tech saved OpenSea millions. It also maintains the entire objective of NFTs. This stops buyers from buying fake blue-chip NFTs, which would hurt the credibility of ALL NFTs. NFTs are verifiable, original tokens that you cannot duplicate on-chain. If that goes out the window, so does the entire NFT market.
A Dangerous Precedent to Set
Not rewarding good actors who are trying to help the community will only attract bad actors trying to do the opposite. Only offering USD 15k equivalent for a bug that would potentially cost the market hundreds of millions of dollars is a dangerous precedent to set.
Why would someone work on or notify OpenSea of a market-saving bug anymore?
Where is the motivation if other companies are offering millions of dollars?
With plenty of other options available, White Hats will flock to platforms that are willing to reward them. Not only that, but white hats may take the next steps into their own hands in the future.
Rug said this be the last time Rug.Tech works in any capacity with OpenSea directly. “In the future, we will take other routes to bring attention to bugs we find”.
OpenSea went down shortly after this original thread was posted, but is since back live.
Do you think this was a suitable reward for the bug the team at Rug.Tech found? Post a comment below or on Twitter!
