Thirdweb, a Web3 software development kit (SDK) provider, confirmed the presence of a security vulnerability in a widely used open-source library, impacting numerous Web3 smart contracts, according to a Dec. 4 statement on social media platform X (formerly Twitter).
The firm stated that the vulnerability was initially identified on Nov. 20 and impacted a variety of smart contracts across the web3 ecosystem, including some of its pre-built smart contracts.
However, it clarified that the vulnerability has yet to be exploited and refrained from disclosing the open-source library to prevent potential exploitation. The firm wrote:
“Based on our investigation so far, this vulnerability has not been exploited in any thirdweb smart contracts. However, smart contract owners must take mitigation steps on certain pre-built smart contracts that were created on thirdweb prior to November 22nd, 2023 at 7pm PT.”
Affected smart contracts
Thirdweb identified 13 affected smart contracts, including AirdropERC20, ERC721, ERC1155, and others, impacted by the vulnerability.
Smart contract owners are advised to take proactive mitigation steps to prevent exploitation. Additionally, Thirdweb assured ongoing efforts with security partners to develop tools for easy identification and execution of necessary mitigation measures.
Depending on the contract’s nature, these steps might involve contract locking, snapshot creation, and migration to a new contract. Additionally, users of these contracts are encouraged to revoke approvals on all Thirdweb contracts.
Thirdweb is also increasing the bounty rewards for its platform to $50,000 and is implementing a more rigorous auditing process.
Meanwhile, 0xngmi, the pseudonymous developer of DeFillama, urged the community to revoke their approvals to thirdweb contracts because people might have interacted with them without knowing as they are white-labeled.
NFT projects respond
Several NFT projects, including OpenSea, have responded to concerns raised by the vulnerability.
OpenSea confirmed discussions with Thirdweb regarding security concerns in specific NFT collections. The NFT platform hinted at forthcoming support for affected collection owners and anticipated changes related to contract migration on their platform.
Some NFT collections like CoolCats and ApesRare have reassured their holders they are not affected by these vulnerabilities.
However, Thirdweb’s disclosure approach has received criticism within the community.