According to thirdweb, this vulnerability was present\u2014but not yet taken advantage of\u2014in a number of thirdweb\u2019s pre-built smart contracts. \u201cBased on our investigation so far, this vulnerability has not been exploited in any thirdweb smart contracts. However, smart contract owners must take mitigation steps on certain pre-built smart contracts that were created on thirdweb prior to November 22nd, 2023 at 7pm PT,\u201d they said in a post<\/a> on X.<\/p>\n IMPORTANT <\/p>\n On November 20th, 2023 6pm PST, we became aware of a security vulnerability in a commonly used open-source library in the web3 industry.<\/p>\n This impacts a variety of smart contracts across the web3 ecosystem, including some of thirdweb\u2019s pre-built smart contracts.\u2026<\/p>\n \u2014 thirdweb (@thirdweb) December 5, 2023<\/a><\/p><\/blockquote>\n<\/div>\n<\/figure>\n Thirdweb noted that the vulnerability may have been present in some of the pre-built contracts that their users had set up to drop fungible or non-fungible tokens\u2014including some ERC20, ERC721 and ERC1155s.<\/p>\n While they have not disclosed the nature of the vulnerability\u2014stating<\/a> on their newly-launched mitigation website<\/a> that this would risk the security of others\u2014thirdweb have included a full list of their affected contracts on that site, and have provided detailed instructions and tools for their users who need to take immediate steps to mitigate the risk. \u201cIn most cases, the mitigation steps will involve locking the contract, taking a snapshot and migrating to a new contract without the known vulnerability. The exact steps you need to take will depend on the nature of your smart contract, and you can determine these using the [mitigation] tool,\u201d they said on X.<\/p>\n At present, the extent of where and how this vulnerable open-source library is deployed in other smart contracts across the web3 ecosystem is confirmed\u2014which is causing concern across web3, with developers, builders and creators fielding worried questions from clients and colleagues. \u201cHas anything actually been disclosed? I\u2019ve seen this \u2018we found something\u2019 post and a bunch of others like Rarible saying \u2018they found something\u2019 but no one has said what it is or what to do or even what is impacted exactly. It\u2019s a little frustrating because I woke up to a dozen panicked emails from various projects I\u2019ve worked on saying \u2018are we impacted? What do we need to do??\u2019 And all I can say is \u2018no idea, we just have to wait and see what gets revealed in the coming days,\u2019\u201d Sean Bonner<\/a>, artist and veteran project creator, told nft now. \u201cIt would have been nice if the announcement also included the fix instead of just launching everyone into the unknown,\u201d he said.<\/p>\n Today, thirdweb announced that some of their smart contracts are affected by a security vulnerability in a commonly used open-source library. <\/p>\n Rarible utilized some of these smart contracts with various drops. <\/p>\n At this time, this vulnerability has not\u2026 https:\/\/t.co\/PzXM0ZJaQj<\/a><\/p>\n \u2014 Rarible (@rarible) December 5, 2023<\/a><\/p><\/blockquote>\n<\/div>\n<\/figure>\n As thirdweb\u2019s contracts have been commonly used to create NFT collections, marketplaces have been quick to respond, including OpenSea<\/a>, Coinbase NFT<\/a> and Rarible, which used affected thirdweb contracts in a number of drops. Although information is still sparse, the marketplaces have taken public steps to reassure users. In a post<\/a> on X, Rarible addressed creators. \u201cIf your drop was on Polygon, there\u2019s nothing you need to do. We are mitigating the issue, and we will be in touch when the solution has been implemented. If your drop was on Ethereum, you don\u2019t need to do anything yet. We will address the vulnerability, and will be in touch with a plan for redistributing tokens on a secured contract. We will continue to monitor this issue & keep our users informed,\u201d they posted.<\/p>\n \u201cOpenSea is in touch with thirdweb after their disclosure of a security vulnerability that impacts a subset of collections,\u201d their spokesperson told nft now. \u201cThirdweb has published a blog post that outlines the steps creators can take to migrate their collections to a new smart contract without the known vulnerability. We strongly encourage impacted collection owners to take action, and we are evaluating how to support the newly migrated collections on OpenSea,\u201d they said.<\/p>\n Although the issue\u2019s underlying cause is linked to third-party tooling, the OpenSea team is coordinating closely with thirdweb to support a resolution, while taking proactive measures on their own platform to ensure user safety. They also emphasized that their own SeaDrop contract is not affected. In response to a question on X, OpenSea business development lead Will Brooke underscored this point. \u201cConfirmed\u2014does not affect ERC721SeaDrop,\u201d he wrote<\/a>.<\/p>\n\n
\n
![\"\u26a0\"](\"https:\/\/s.w.org\/images\/core\/emoji\/14.0.0\/72x72\/26a0.png\")
Important PSA: <\/p>\n![\"thirdweb](\"https:\/\/nftnow.com\/wp-content\/uploads\/2023\/12\/Thirdweb-Logo-Black-BG.png\"){kind=logo}
<\/figure>\n