- A Sandbox bug enabled the creation of unbacked SAND tokens on Base and on BNB Smart Chain.
- Blockaid, a blockchain security firm, said that it found around $49 billion in face value fake SAND, which is over 400 transactions.
- Both affected networks are not yet bridged while SAND on Ethereum and Polygon still isn’t affected.
A significant cross-chain security incident, with unbacked SAND tokens minted on Base and BNB Smart Chain, has now been taken into account in the Sandbox. The individual total value of these fake tokens equated to an impressive $49 billion, but the project claims they account for less than 0.01% of the project’s total supply of SAND.
Table of Contents
SAND Bridge Exploit Triggers Emergency Shutdown
The Sandbox said the issue surveyed its cross-chain bridge infrastructure, linking SAND and BSC to Base. This meant an attacker could mint SAND tokens without the supporting asset that is normally needed for the assets that were bridged.
The project was implemented by shutting all activity of bridging and unbridging the two networks. As a result, SAND currently held on Base and BSC is isolated and cannot be transferred back through the bridge or redeemed through the affected cross-chain routes. Traders too received a clear warning from The Sandbox.
Users have been warned not to purchase, sell or trade SAND on either Base or BSC due to the liquidity on those networks.
The Sandbox said that it did not face any impact in either Ethereum or Polygon deployments. The project said that no user wallet was compromised and that the SAND locked on the Ethereum side that hosts valid bridged tokens is intact.
$49 Billion Figure Reflects the Scale of Fake Token Minting
Estimates of the amount of assets lost or pulled from the protocol are not necessarily $49 billion. Rather, it shows the market value for the many unbacked tokens that were created as part of the exploit.
Fake Supply Cannot Be Treated as Legitimate Liquidity
It is worth noting that the attack-made SAND is not supported by the reserves of the legitimate cross-chain supply, which is why this distinction is significant. An investigation is ongoing and a detailed incident report and technical post mortem will follow, it said.
Compensation Plan Targets Affected Liquidity Providers
Preparation for a compensation plan is on-going including taking a snapshot of the Sandbox ecosystem prior to the incident.
The plan will target BSC users in selected liquidity pools on Base. The project has yet to release the ultimate compensation package or the sum that might be available. The Sandbox stated there’s nothing for regular SAND holders on Ethereum and Polygon to do.
The incident again brings security concerns involving cross-chain infrastructure to the fore. The Sandbox’s immediate focus is to contain the affected networks, analyze its extent, and plan on repaying eligible liquidity providers.
