BSC NFT auction marketplace exploited via double-settlement logic error, draining $8.3K from escrow pool.
Security & Exploits ·
A logic error in an NFT auction marketplace on BNB Chain allowed an attacker to extract approximately $8.3K by exploiting a double-settlement vulnerability. The attacker minted a throwaway NFT, listed it for auction, and then executed a single transaction that both purchased the listing and immediately delisted it—triggering duplicate refunds from the escrow pool.
The vulnerability stemmed from incomplete state management in the marketplace's completion logic. When a sale was finalized via buyNow→completeAuction, the contract sent payment to the seller but failed to clear the sale's paid status. A subsequent delist call then refunded the same amount again, this time from communal escrow funds. The attacker, acting as both buyer and seller, profited approximately $4.06K (2.2176 BNB) while the marketplace contract lost roughly $8.3K in drained escrow reserves.
The marketplace proxy remains unverified on-chain, limiting post-incident transparency. No patched version, recovery timeline, or formal incident statement has been reported. The attack was facilitated by flash-loaned liquidity, highlighting how initial capital constraints can be circumvented in protocols with improper state validation.