Thread by @UDTradingClub

We took a look at the events of the Unstoppable Domains auction held on Rarible.

TL;DR:

There were some interesting exploits and bugs from Rarible + mysterious events revolving around... Gaunter O'Dimm?

Here's what we found.

@unstoppableweb @rarible @AdLunamInc

1/18

Unstoppable reports that Rarible's auction mechanism may have been exploited to lock out legitimate bids.

https://twitter.com/matthewegould/status/1708528927918993719

The exploit is sometimes referred to as "Bid Shielding" and works as follows:

1. Wallet A places a low bid.

2. Wallet B places a particularly high bid that no one is likely to defeat.

3. Since the Rarible UI stops most users from placing bids that are lower than the highest bid, this locks people out from further bidding. (A design flaw from Rarible.)

4. Wallet B then removes all the WETH from their wallet just before the timer runs out, therefore making it impossible for Unstoppable to actually accept the high bid.

5. This forces Unstoppable to accept the low bid from Wallet A, losing them money.

On the image above, we can see that Bid Shielding was successfully performed by a person calling themselves Gaunter O'Dimm.

We got lucky here, as Rarible's activity history is often unreliable, following reports from witnesses that unsuccessful bids sometimes disappear completely from the UI (we're not sure why). Those ones are difficult to pinpoint because unsuccessful bids are not recorded on-chain.

Next, there was another issue on the auction:

Nadja Bester of @AdLunamInc claims that a different bug/exploit might have also occurred with Rarible, resulting in the loss of her funds.

https://twitter.com/NadjaBester/status/1708191454839865661

Nadja claims that funds were taken from her wallet despite not receiving the domain they bid for ("Tokens.x").

(Mentioned above on her video at 3:00.)

Looking at the Rarible activity history for Tokens.x, there does seem to be evidence of something going wrong, but it's unclear how or what.

The auction should have closed after 10 minutes without a new bid, but the activity history shows the auction continued.

(>10 minutes after.)

Again, the domain went to Gaunter O'Dimm.

Lastly, some other odd activity was present on the auction:

There was a wallet going by the name of "Ghadfather.crypto" that won several bids and immediately re-sold the domains to other wallets making bids on the same auction. (Sometimes for lower amounts than what he paid for them.)

The reason is currently unclear.

These are the domains that were sold twice:

Cameras.x
-Sold to Ghadfather for 0.755 ETH.
-Immediately resold to 00.nft for 0.56 ETH.

Savings.x
-Sold to Ghadfather for 0.6 ETH.
-Immediately resold to Gaunter O'Dimm for 0.48 ETH.

Cruise.x
-Sold to Ghadfather for 0.55 ETH.
-Immediately resold to Gaunter O'Dimm for 0.56 ETH.

These were the accounts involved:

Ghadfather.crypto:
0xf4e290490351b23316df3235266267c0bc18f298

Gaunter O'Dimm:
0xcb45adccd82d5379124702ba72904a43a5b6f584

00.nft:
0xd90c119592aa444c177348a4445141f6f21a3931

Again, Gaunter O'Dimm's name shows up.

Although, we're not sure what the point was of this odd exchange with Ghadfather.crypto and 00.nft, but it seems bizzare enough to point out.

It's relevant to mention here that the Ghadfather.crypto wallet was accused of bid shielding on a previous Unstoppable Domains Rarible auction as well.

Also interesting to note: "Ghadfather.crypto" is the name they set for themselves on Rarible, but their wallet does not actually own that domain.

As of this writing, "Ghadfather.crypto" is a domain that has not been bought.

On the other hand, the name "Gaunter O'Dimm" is a reference to The Witcher character of the same name. A mysterious devil-like figure who makes deals with individuals, but his deals often go wrong, usually resulting in death for the bargainers.

All in all, crypto was lost for @unstoppableweb and @AdLunamInc, but we're lucky no one died here.

Slight correction:

We're not sure why Rarible displayed a 72 ETH bid, as Gaunter O'Dimm did not actually hold 72 ETH. But it still appears that some form of bid shielding occurred on several items.

See the activity tab here:
rarible.com/token/0x049aba…

Update:

It has been confirmed that @NadjaBester has not in fact lost any funds on the @rarible auction.

Their wallet which was identified to be JasonFernandes.eth (0x1FbA1bE88828522F3c7580dfbD4D482834659896) has not lost the 2 ETH that they claim went missing.

It appears their grievance was the result of them misunderstanding the process of wrapping ETH to WETH.

(i.e. They wrapped 2 ETH and thought it disappeared.)

Despite this being pointed out several times, they now appear to be simply refusing to acknowledge the mistake.

Though it's true that Nadja lost on their bid for the domain "Tokens.x" due to a bug from Rarible, the situation does not seem to be as serious as previously thought, since Nadja's funds are now confirmed to be intact.

As of the moment, it does not seem Rarible is guilty of any malicious intent, aside from having a woefully buggy platform that allowed bid shielding and late auction entries from bidders. (To which Rarible should bear some responsibility.)