5 ms·

This isn’t a big deal. This guy just created his own smart contract with a special code snippet that, after he mints an NFT to beeple’s address, allows his addr

This isn’t a big deal. This guy just created his own smart contract with a special code snippet that, after he mints an NFT to beeple’s address, allows his address to still transfer it to another address (himself). On Rarible/etc this then makes it appear that Beeple minted it and then transferred it to him. This is why you need to publish the code for NFT smart contracts... which pretty much everyone does, which makes real NFTs auditable and secure (enough). He wouldn’t be able to mint a duplicate NFT from the same smart contract Beeple originally used. Lol, self-proclaimed “banksy of NFTs”, come on

simplecto 5y ago
No. It is a big deal. Forgery is forgery, and this is a fundamental flaw in the ERC-721 token. Provenance matters, and this is more than a shot across the bow. This is a direct hit on trust. I only have to fool you long enough to get the tokens into my wallet. This kind of forgery seems to do the trick.
- vmception 5y ago
  Its up to the market to discern the earlier date of the original issuance. Its always been this way. The blockchain just allows for easier provenance instead of hearsay. If you buy a duplicate art piece or an art piece that was "sleepminted" just because a popular artist addresses "dropped it", that's really on you this sounds more like a UI problem that can be easily solved try not to get scammed, ripped off, or if you want to buy things with resale value in the future maybe just avoid the entire NFT market and not worry about a UI issue
- homedepotdave 5y ago
  Ok -- sorry -- sure. This hack may trick some people and that sucks. I too am generally skeptical of the NFT world. But if you just use the general rule of only buying NFTs that are minted to smart code with published code, that basically solves this problem. Also worth mentioning that two weeks ago this guy -- before posting all this BS -- first tried to sell this fake for 369,122 ETH lol. https://rarible.com/token/0x5fbbacf00ef20193a301a5ba20acf04765fb6dac:40914:0xc6b0562605d35ee710138402b878ffe6f2e23807?tab=history https://rarible.com/token/0x5fbbacf00ef20193a301a5ba20acf047...
kolinko 5y ago
You can also check the decompiled source on eveem.org - doesn’t work with everything, but even if sources are public it’s good to double-check them there. (I’m the creator of eveem)
- miracle2k 5y ago
  Thank you for your work. I would imagine working on decompilers is quite thankless, but immensely important.
BelenusMordred 5y ago
> you need to publish the code for NFT smart contracts... which pretty much everyone does How do you not publish smart contract code on a public blockchain? This statement makes no sense. At best you could pull some obfuscation tricks which only serves to makes you look dodgy as fuck.
- homedepotdave 5y ago
  When I push a smart contract to the blockchain, it's in bytecode format -- impossible to read. There are some tools that try to decompile the bytecode back to the (readable) source code, but most I've seen aren't great. Take Rarible's smart contract: https://etherscan.io/address/0xd07dc4262bcdbf85190c01c996b4c06a461d2430#code https://etherscan.io/address/0xd07dc4262bcdbf85190c01c996b4c... They published the actual code on Etherscan, so when you click "Contract" you can see the Solidity code. Etherscan compiles this Solidity code to confirm it matches the bytecode exactly. It also allows normal people to review the code. Compare that to the smart contract this 'banksy of nfts' published: https://etherscan.io/address/0x5FBbACf00ef20193a301a5BA20acf04765fb6DaC#code https://etherscan.io/address/0x5FBbACf00ef20193a301a5BA20acf... You can't review the Solidity code, all there is is bytecode. Basically, you shouldn't buy an NFT that hasn't published the source code of its smart contract because you have NO idea what you are getting.

simplecto 5y ago

No. It is a big deal. Forgery is forgery, and this is a fundamental flaw in the ERC-721 token. Provenance matters, and this is more than a shot across the bow. This is a direct hit on trust. I only have to fool you long enough to get the tokens into my wallet. This kind of forgery seems to do the trick.

vmception 5y ago
Its up to the market to discern the earlier date of the original issuance. Its always been this way. The blockchain just allows for easier provenance instead of hearsay. If you buy a duplicate art piece or an art piece that was "sleepminted" just because a popular artist addresses "dropped it", that's really on you this sounds more like a UI problem that can be easily solved try not to get scammed, ripped off, or if you want to buy things with resale value in the future maybe just avoid the entire NFT market and not worry about a UI issue
homedepotdave 5y ago
Ok -- sorry -- sure. This hack may trick some people and that sucks. I too am generally skeptical of the NFT world. But if you just use the general rule of only buying NFTs that are minted to smart code with published code, that basically solves this problem. Also worth mentioning that two weeks ago this guy -- before posting all this BS -- first tried to sell this fake for 369,122 ETH lol. https://rarible.com/token/0x5fbbacf00ef20193a301a5ba20acf04765fb6dac:40914:0xc6b0562605d35ee710138402b878ffe6f2e23807?tab=history https://rarible.com/token/0x5fbbacf00ef20193a301a5ba20acf047...

kolinko 5y ago

You can also check the decompiled source on eveem.org - doesn’t work with everything, but even if sources are public it’s good to double-check them there. (I’m the creator of eveem)

miracle2k 5y ago
Thank you for your work. I would imagine working on decompilers is quite thankless, but immensely important.

BelenusMordred 5y ago

> you need to publish the code for NFT smart contracts... which pretty much everyone does How do you not publish smart contract code on a public blockchain? This statement makes no sense. At best you could pull some obfuscation tricks which only serves to makes you look dodgy as fuck.

homedepotdave 5y ago
When I push a smart contract to the blockchain, it's in bytecode format -- impossible to read. There are some tools that try to decompile the bytecode back to the (readable) source code, but most I've seen aren't great. Take Rarible's smart contract: https://etherscan.io/address/0xd07dc4262bcdbf85190c01c996b4c06a461d2430#code https://etherscan.io/address/0xd07dc4262bcdbf85190c01c996b4c... They published the actual code on Etherscan, so when you click "Contract" you can see the Solidity code. Etherscan compiles this Solidity code to confirm it matches the bytecode exactly. It also allows normal people to review the code. Compare that to the smart contract this 'banksy of nfts' published: https://etherscan.io/address/0x5FBbACf00ef20193a301a5BA20acf04765fb6DaC#code https://etherscan.io/address/0x5FBbACf00ef20193a301a5BA20acf... You can't review the Solidity code, all there is is bytecode. Basically, you shouldn't buy an NFT that hasn't published the source code of its smart contract because you have NO idea what you are getting.