Check Point Research (CPR) identified a security flaw in Rarible, the NFT marketplace with over two million active users. If exploited, the vulnerability would have enabled a threat actor to steal a user’s NFTs and crypto tokens in a single transaction. CPR immediately disclosed findings to Rarible, who acknowledged the security flaw. CPR’s revelations mark the second time that their researchers discovered security flaws in an NFT marketplace. In October 2021, CPR found security issues in OpenSea, the world’s largest NFT marketplace. CPR’s research motivations into Rarible was sparked when they witnessed a similar attack on Jay Chou, a famous Taiwanese singer, whose NFT was stolen and sold for $500k. 

  • A successful attack would have come from a malicious NFT within Rarible’s marketplace itself, where users are less suspicious and familiar
    with submitting transactions
  • Exploitation begins with a victim receiving a link to the malicious NFT who then clicks on it
  • CPR warns that we will continue to see crypto wallet theft around the world and shares four safety tips

Check Point Research (CPR) identified a security flaw in Rarible, the NFT marketplace with over two million monthly active users. If exploited, the vulnerability would have enabled a threat actor to steal a user’s NFTs and cryptocurrency wallets in a single transaction. A successful attack would have come from a malicious NFT within Rarible’s marketplace itself, where users are less suspicious and familiar with submitting transactions. CPR alerted Rarible of its findings immediately.

In 2021, Rarible reported over $273 million trading volume in 2021, making Rarible one of the largest NFT marketplaces in the world.

Attack Methodology

CPR outlined the attack method, as the following:

  1. Victim receives a link to the malicious NFT or browses the marketplace and clicks on it.
  2. The Malicious NFT executes JavaScript code and attempts to send a setApprovalForAll request to the victim.
  3. Victim submits the request and grants full access to this NFT’s/Crypto Token to the attacker.

Research Motivations

On April 1, CPR witnessed a similar attack on Jay Chou, a famous Taiwanese singer. He was tricked into submitting a transaction that stole his BoardAppe NFT 3738 that later sold for $500,000 on the marketplace. CPR became intrigued, as the victim of this method can be any crypto/NFT holder. CPR quickly launched a thorough investigation of Rarible. CPR’s motivation behind this latest research is to prevent risks of account takeover and cryptocurrency theft.

CPR’s current findings build on top of previous research in October 2021, where they found critical security flaws in OpenSea, the world’s largest NFT marketplace. Left unpatched, the vulnerabilities discovered on OpenSea’s platform could allow hackers to hijack user accounts and steal entire cryptocurrency wallets by crafting malicious NFTs.

Responsible Disclosure

CPR disclosed its findings to Rarible on Tuesday, April 5 2022, who then collaborated with our researchers, acknowledged the flaw and installed a fix.

Safety Tips

  • CPR recommends being careful and aware whenever receiving requests to sign even within the marketplace itself.
  • Prior to approving a request, users should carefully review what is being requested, and consider whether the request seems abnormal or suspicious.
  • If there are any doubts, users are advised to reject the request and examine it further before providing any kind of authorization.
  • Users are advised to review and revoke token approvals under this link:  https://etherscan.io/tokenapprovalchecker.

The full research can be found at the CP<R> Blog

You may also like