Web3 developer Thirdweb boosts bounty to $50,000 in light of fresh smart contract security risks Web3 developer Thirdweb boosts bounty to $50,000 in light of fresh smart contract security risks
The platform confirmed the presence of a security vulnerability in a widely used unnamed open-source library.
2 min read
Updated: Dec. 5, 2023 at 3:17 pm UTC
Cover art/illustration via CryptoSlate. Image includes combined content which may include AI-generated content.
Thirdweb, a Web3 software development kit (SDK) provider, confirmed the presence of a security vulnerability in a widely used open-source library, impacting numerous Web3 smart contracts, according to a Dec. 4 statement on social media platform X (formerly Twitter).
The firm stated that the vulnerability was initially identified on Nov. 20 and impacted a variety of smart contracts across the web3 ecosystem, including some of its pre-built smart contracts.
However, it clarified that the vulnerability has yet to be exploited and refrained from disclosing the open-source library to prevent potential exploitation. The firm wrote:
“Based on our investigation so far, this vulnerability has not been exploited in any thirdweb smart contracts. However, smart contract owners must take mitigation steps on certain pre-built smart contracts that were created on thirdweb prior to November 22nd, 2023 at 7pm PT.”
Affected smart contracts
Thirdweb identified 13 affected smart contracts, including AirdropERC20, ERC721, ERC1155, and others, impacted by the vulnerability.
Smart contract owners are advised to take proactive mitigation steps to prevent exploitation. Additionally, Thirdweb assured ongoing efforts with security partners to develop tools for easy identification and execution of necessary mitigation measures.
Depending on the contract’s nature, these steps might involve contract locking, snapshot creation, and migration to a new contract. Additionally, users of these contracts are encouraged to revoke approvals on all Thirdweb contracts.
Thirdweb is also increasing the bounty rewards for its platform to $50,000 and is implementing a more rigorous auditing process.
Meanwhile, 0xngmi, the pseudonymous developer of DeFillama, urged the community to revoke their approvals to thirdweb contracts because people might have interacted with them without knowing as they are white-labeled.
NFT projects respond
Several NFT projects, including OpenSea, have responded to concerns raised by the vulnerability.
OpenSea confirmed discussions with Thirdweb regarding security concerns in specific NFT collections. The NFT platform hinted at forthcoming support for affected collection owners and anticipated changes related to contract migration on their platform.
Some NFT collections like CoolCats and ApesRare have reassured their holders they are not affected by these vulnerabilities.
However, Thirdweb’s disclosure approach has received criticism within the community.
Mentioned in this article
Author 
Oluwapelumi Adejumo
Oluwapelumi values Bitcoin's potential. He imparts insights on a range of topics like DeFi, hacks, mining and culture, underlining transformative power.
Featured Story
Advertise Here
In this article
Ethereum is a decentralized, open-source blockchain platform that enables the creation of smart contracts and decentralized applications (DApps).
Coinbase NFT
Coinbase NFT is a digital marketplace where you can mint, collect, discover and showcase your NFTs, all in one place..
OpenSea
OpenSea is a decentralized peer-to-peer marketplace for buying, selling, and trading NFTs.
