Yuga Labs revoked the smart contract that allowed it to mint an unlimited number of Bored Ape Yacht Club (BAYC) NFTs, a year after first promising to do so.
tx in question: https://t.co/fmLjnFapvb
— EmperorTomatoKetchup (@TomatoBAYC) June 7, 2022
“The contract’s ownership has now been burned. We’ve wanted this for a long time, but did not do so for security reasons. We feel comfortable having done so,” wrote the project’s co-founder under the nickname EmperorTomatoKetchup.
As proof, he disclosed the transaction by which the developers removed the minting capability.
Blockworks specialists reminded the Yuga Labs team of the issue:
“A single private key can mint an infinite number of Bored Apes.”
A single private key can mint an infinite number of new Bored Apes pic.twitter.com/t30homR1wg
— Blockworks (@Blockworks_) June 5, 2022
In the event of a wallet breach, this would allow attackers to flood the market with tokens, pushing prices down. At the time of writing, the cheapest BAYC on the OpenSea marketplace is priced at 69.69 ETH (~$126,835), while the most expensive trades at 18,880 ETH (~$34.4 million).
Users first noticed that the BAYC code contained a mechanism to mint NFTs beyond the stated 10,000 tokens, in June 2021.
“Thanks, we were just talking about this. Obviously, we’re never going to call that function again and we intend to revoke ownership in the next day or two,” the project team replied at the time.
Hey thanks, we were just talking about this. Obviously, we’re never going to call that function again and we’re planning on revoking ownership in the next day or two.
— Bored Ape Yacht Club (@BoredApeYC) June 2, 2021
That promise was fulfilled only on June 7, 2022.
Three days earlier, hackers breached the project’s Discord servers and posted phishing links in the channels of communication.
In March, attackers carried out a similar successful attack on the Bored Ape Yacht Club’s Instagram account.
As noted in February, BuzzFeed journalist de-anonymized two of the four co-founders of the NFT collection under the aliases GordonGoner and Gargamel. Who is behind the aliases EmperorTomatoKetchup and NoSass remains unknown.