# I, Degen - E5: Aku the Moon God Sacrifices 11K ETH - 4/30/2022

::: info
Listen at: idegen.fm
:::

:::success
Contact us: [@idegenfm](https://twitter.com/idegenfm)
:::

#### Intro
Welcome to I, Degen - Each week, we track down and explore the most exciting crypto stories. Hacks, scams, exploits, and anything that feeds our crypto curiosity.

Welcome degens! Come one, come all.

#### Episode Summary
In this week’s episode, we take a look at the AkuTars NFT contract auction bugs that permanently locked 11,539 ETH

# I,Degen - Weekly

1. SilkRoads stolen BTC, recovered by US Gov and used to cover Ross Ulbricht's debt - [Beincrypto](https://beincrypto.com/silk-road-founder-ross-ulbricht-to-forfeit-3-billion-in-btc-extinguishes-debt-to-government/)

1. [From the block](https://www.theblockcrypto.com/linked/143193/state-lawmakers-want-to-make-fraudulent-rug-pulls-a-crime-in-new-york) New York Lawmakers want to make rug pulling a crime

1. ERC712R introduces refundable NFTs to help reduce scams, criticism comes fast. Nice discussion on [Markets Daily podcast](https://open.spotify.com/episode/3f480Q0EfhpDGhVAgggWyz?si=E68Pf2HJStmMMROLntNTNg)

1. BAYC holders targeted again. This time hackers owned BAYC's Insta page, posted a scam claim for BAYC owners were entitled to an airdrop for virtual land. Instead, the link lifted ape and mutant apes, and other NFTS is the victims wallet. [From the Defiant](https://thedefiant.io/bayc-instagram-hack/) - "The hacker stole 91 NFTs in total, including four Bored Apes, and seven Mutant Apes. Just those 11 NFTs are worth $2.6M going by current floor and ETH prices as of Apr. 25.""

1. OG Zcash trusted ceremony anon John Dobbertin turns out to be Edward Snowden. [From Zcash Media](https://twitter.com/zooko/status/1519723443628904448?s=21&t=YuApU_0Q-QKploS4tQlKOQ)

1. [From Coindesk](https://www.coindesk.com/policy/2022/04/28/panama-legislature-passes-bill-regulating-crypto/) Panama Legislature Passes Bill Regulating Crypto. Aimed and bringing crypto projects to Panama and other important things.

1. Massive 15.3 million request-per-second (RPS) volumetric https DDoS attack targets undisclosed crypto launchpad. The attack only lasted 15 seconds but notable for it's size and use of HTTPS. [From HackerNews](https://thehackernews.com/2022/04/cloudflare-thwarts-record-ddos-attack.html)

1. [Another from Coindesk](
https://www.coindesk.com/tech/2022/04/28/ethereum-name-service-nfts-overtake-bayc-in-daily-trade-volume/) Ethereum Name Service overtakes Bored Ape Yacht Club in daily trading volume in rush for short digit addresses. Race to grab first 10k numeric ENS addys partly to blame.

# I, Degen - Deep Dive

### Moment of Slience - $34 million, or 11,539 eth, is permanently locked into the AkuDreams contract forever.

**What is Aku?**
> Aku is a character created by former MLB player turned artist, Micah Johnson, after hearing a young boy ask, “Can astronauts be black?”

> Aku was released to the world on Feb 21, 2021 as an NFT in the form of an animated video

-- [Aku.wolrd](https://aku.world/)

Ten chapters in total, with each chapter in it's own style.

Next, comes the Akutars...[new drop, 4/22/22.](https://twitter.com/AkuDreams/status/1517529656081145859)

**What are the Akutars:**
> Akutars are a collection of 15,000 unique, 3D Aku avatars with partnerships from; Puma, Planes, Vandal, Who Decides War, BBC and, Ice Cream. Each Akutar grants you entry into the ever-expanding Akuverse, where lines are blurred between the digital and physical worlds and owners gain exclusive access to culture-defining experiences, products, and collaborations.
-- [Akutars on OpenSea](https://opensea.io/AkuDreams?tab=created)

> So this drop was dutch auction with a unique feature that allowed the lowest bid to set the price for all minters. -- [Tweet](https://twitter.com/dapperSBD/status/1517766010442375168)

Then, when the auction ends, any bid higher than the lowest bid will receive a refund of the lowest bid, minus gas fees.

Example:

This is an interesting and cool mechanism. However, there was some faulty logic in the contract.

First issue: If you bid on the auction from a contract, and that contract didn't have a fallback function to handle incoming ETH, the then the refund loop would fail. This was exploited, however, the attacker was kind enough to build a switch into their contract that would bypass the failure and allow the refund loop to continue.


There is some mention that this bug was pointed out to the AkuDreams team ahead of time and they ignored it. I wasn't able to verify that.

Next Issue: Bigger issue. The contract was designed to keep track of the bids, and addresses that made those bids. A simple ++ was used to increment the counter. However, this counter didn't account for cases where a single address bid on more than one Akutar. AKA, multi-mint in a single transaction. This left the total bid count short. There were 5495 total Auktars to be auctioned, but bid counter only made it to 3669.

During the refund loop, there is a check to confirm:

\# this will fail because of the bid counter issue
`require(_refundProgress < _bidIndex)`

and then, in the claimProjectFunds function:
\# This too will fail
`require(refundProgress >= totalBids)`

Sooo... 11k ETH is permanently stuck.

**What's strange:**
- AkuDreams Twitter appears unfazed.
- not audited?
- not tested?
- lots of questionable info floating around on twitter

**links:**
* [Aku, The Moon God, and the new age of Web3 Media](https://members.delphidigital.io/reports/aku-the-moon-god-the-new-age-of-web3-media)
* https://www.instagram.com/aku.dreams
* [Nice twitter write up from )xInuarashi](https://twitter.com/0xInuarashi/status/1517674505975394304s=21&t=VBPbbV78ln-agS2QAtRGxA)
* [Akutars Auction Contract](https://etherscan.io/address/0xf42c318dbfbaab0eee040279c6a2588fa01a961d#code)

# I, Degen - Freestyle Convo
???

[[[Outro]]]

:::warning
We do our best to report accurately on the topics we discuss but we're not always going to get everything right. Please comment here or reach out to us @idegenfm with corrections or comments!
:::