Worked example · 2026-06

Flooring Protocol — a crafted high-bit token-ID alias made an ownership check pass for a token the caller did not own, and the balance update behind it underflowed, turning a little WETH into effectively unlimited fpTokens — Flooring Protocol V2 / BitmapPunks (Ethereum) — 2026-06-08

Loss: initial reporting above $900K; white-hat intervention recovered NFTs valued at over $500K. A team linked to Yuga Labs rescued 68 NFTs, including Bored Apes, ahead of the attacker. CryptoPunks and BAYC tokens locked in the protocol were among the assets at risk. Both Flooring Protocol V2 and BitmapPunks were affected, and the flaw subsequently spread to at least one fork, Asterix, which was hit in turn. Net realised loss after the rescue has not been published precisely.
OAK Techniques observed: OAK-T9.004 (Access-Control Misconfiguration — primary mechanism for the first half, with the fit stated precisely: the defect is an authorisation predicate defeated by crafted input rather than a misconfigured role. The BT404-style contract packed ownership and token-indexing data into shared storage, and a malicious high-bit token-ID alias made an ownership check pass while later accounting resolved the same value differently — the condition public analysis named "ghost ownership". See techniques/T9.004-access-control-misconfiguration.md). OAK-T12.008 (Hybrid Fungible / Non-Fungible Standard Accounting Divergence — and this case is its canonical anchor: the exploited surface exists only because one contract maintains two views of the same asset — an ERC-20 balance and per-tokenId ownership — that must stay in agreement, which is the defining property of the ERC-404 / BT404 hybrid family. See techniques/T12.008-hybrid-fungible-non-fungible-accounting-divergence.md). OAK-T5.001 (Hard Drain — the outcome: an unchecked balance update underflowed, granting a balance far larger than intended, so a small WETH deposit produced a near-unlimited quantity of fpTokens — the protocol's ERC-20 representations of fractionalised locked NFTs — which were used to drain the pools and redeem the underlying NFTs). OAK-T9.007 (Fork-Substrate Vulnerability Not Mitigated at Fork Time — the contagion leg: the fork Asterix carried the same unfixed logic and was attacked after the original disclosure).
Attribution: pseudonymous. No named individual or group, no published identity, and no link to a tracked OAK actor. The white-hat side is attributed: a team associated with Yuga Labs executed the rescue of 68 NFTs, an unusually direct intervention by an issuer into a third-party protocol holding its collections.
Key teaching point: When one contract holds two representations of the same asset, the bug is never in either representation — it is in the seam, and the seam is where hybrid token standards live by construction. Flooring's job is to turn a locked NFT into fungible fpTokens and back again, which means an ERC-20 balance and a per-tokenId ownership record must agree at all times. The BT404-style implementation packed both into shared storage for efficiency, and packing is exactly what let a crafted high-bit token-ID alias be read as one thing by the ownership check and as another by the accounting that followed. The second half is older than crypto: an unchecked balance update underflowed, so a subtraction that should have failed instead wrapped into an enormous credit. Neither half alone empties a protocol; together, "the check thinks you own it" plus "the arithmetic cannot go below zero" mints value from nothing. The reusable rules are unglamorous and specific: normalise and bounds-check every identifier before it reaches an ownership predicate — reject aliases, high-bit encodings, and any representation with more than one canonical form; use checked arithmetic on every balance mutation without exception; and assert the cross-representation invariant (Σ fungible supply ⟷ escrowed token count) as a hard runtime check rather than an intended property. The third lesson is about forks: within days the same defect was exploited on Asterix, because a fork inherits the substrate's bugs on day one and its patches never.

Summary

Flooring Protocol converts locked NFTs into fungible fpTokens — ERC-20 representations of fractionalised NFT positions — so that illiquid collection items can be traded and pooled. Its contract model followed the BT404 hybrid design, in which fungible balances and non-fungible ownership are maintained together.

On 2026-06-08, an attacker exploited that model in two composed steps. First, packed ownership and token-indexing logic allowed a malicious high-bit token-ID alias to satisfy an ownership check while the accounting that ran afterwards resolved to something different — public analysis described the resulting state as "ghost ownership". Second, an unchecked balance update underflowed, granting the attacker a balance far larger than intended.

The composed effect was that a small deposit of WETH could be turned into a near-unlimited quantity of fpTokens. The attacker used that manufactured balance to drain Flooring's pools and redeem the underlying NFTs locked in the contract. Both Flooring Protocol V2 and BitmapPunks ran the affected contract model, and high-value assets — including Bored Ape Yacht Club and CryptoPunks tokens — were exposed.

A white-hat team linked to Yuga Labs intervened and rescued 68 NFTs valued at over $500K, moving them out ahead of the attacker. Initial loss reporting had run above $900K before the rescue.

The incident did not stay contained to its origin. Asterix, a fork of Flooring, was attacked afterwards on the same logic — the vulnerability propagating across the fork population before the forks had applied the fix.

Timeline (UTC)

When	Event	OAK ref
(standing)	BT404-style contract packs ownership and token-indexing data into shared storage; a high-bit token-ID alias can satisfy an ownership check while resolving differently in later accounting	(standing T9.004 / T12.008 surface)
(standing)	A balance update on the fungible side is performed without checked arithmetic	(standing underflow surface)
2026-06-08	Attacker crafts the aliased token ID, passes the ownership check, and triggers the underflow — a small WETH deposit yields a near-unlimited fpToken balance	T9.004 → T12.008
2026-06-08	Manufactured fpToken balance is used to drain Flooring pools and redeem underlying NFTs; initial loss reporting above $900K	T5.001
2026-06-08	Yuga Labs-linked white hats rescue 68 NFTs valued at over $500K, extracting them ahead of the attacker	M35
2026-06-08 onward	Both Flooring Protocol V2 and BitmapPunks confirmed affected; contract model paused / remediated	M34
2026-06 (after disclosure)	The fork Asterix is attacked on the same unfixed logic — contagion across the fork population	T9.007
ongoing	No precise published net loss after the rescue; no attacker identification	(open)

What defenders observed

Pre-event (identifiers must have exactly one canonical form before they reach an authorisation check). The exploit begins with a token ID that means one thing to the ownership predicate and another to the accounting. Normalise, bounds-check, and reject high-bit or aliased encodings at the boundary — an identifier with two readings is an authorisation bypass waiting for someone to notice (M02, M16).
Pre-event (checked arithmetic, with no exceptions for hot paths). The value creation is an underflow on a balance update. Unchecked blocks bought gas and cost the protocol its supply invariant.
Pre-event (assert the cross-representation invariant at runtime). For any hybrid or fractionalisation design, Σ fungible supply must correspond to escrowed NFT count × fraction size continuously. Making that an enforced check rather than a documented assumption bounds every seam bug, including ones nobody has named yet (M36).
At-event (a tiny deposit followed by an enormous balance is a one-line detector). Deposit-to-mint ratio outside plausible bounds within a single transaction has no legitimate population in a fractionalisation protocol, and it fires before the pools are drained (M11).
Response (the issuer, not the protocol, ran the rescue). Yuga Labs' team extracted 68 NFTs ahead of the attacker. This is a notable and growing pattern — the collection issuer has both the reputational exposure and the technical capacity to intervene in a third-party protocol holding its assets, even though it has no formal relationship with that protocol's security (M35).
Response (fork contagion is predictable and was not pre-empted). Asterix inherited the logic and was attacked after the original was public. Any protocol whose code has been forked should treat disclosure as a multi-deployment coordination problem, and fork operators should track upstream advisories as a standing obligation (M22).

Public references

[nfteveningflooring2026] — NFT Evening, "White Hats Rescue $500K in NFTs After Flooring Protocol Exploit" (the 2026-06-08 dating, the 68 NFTs valued above $500K, the Yuga Labs-linked white-hat rescue, and the fpToken inflation mechanism — a small WETH deposit generating a near-infinite balance of the ERC-20 representations of fractionalised locked NFTs): https://nftevening.com/white-hats-rescue-500k-nfts-flooring-protocol-exploit/
[thedefiantflooring2026] — The Defiant, "Yuga Labs Executes White-Hat Rescue of 68 NFTs After Flooring Protocol Exploit" (independent account of the rescue and of the accounting flaw allowing inflated fpToken balances, pool drainage, and redemption of locked NFTs): https://thedefiant.io/news/hacks/yuga-labs-white-hat-rescue-68-nfts-flooring-protocol-exploit
[bitcoinfoundationflooring2026] — Bitcoin Foundation news, "Flooring Protocol Exploit Puts BAYC, CryptoPunks NFTs at Risk" (the exposure of Bored Ape and CryptoPunks assets locked in the protocol, and the above-$900K initial loss reporting): https://bitcoinfoundation.org/news/nft/flooring-protocol-exploit-put-bored-apes-cryptopunks-nfts-at-risk/
[cryptonewsasterix2026] — CryptoNews, "Asterix hit as Flooring Protocol vulnerability spreads across forks" (the fork-contagion leg: the same logic exploited against a Flooring fork after the original disclosure): https://cryptonews.net/news/security/32987389/
[slowmistzoneflooring2026] — SlowMist Hacked (zone entry, 2026-06-08, Flooring Protocol & BitmapPunks, "Smart Contract Vulnerability", described as a BT404-style packed-ownership vulnerability combining a malicious high-bit token-ID alias with an unchecked integer underflow, enabling excess token minting and the draining of NFTs worth over $500,000): https://hacked.slowmist.io/?c=NFT

Discussion

Flooring is the case that keeps the T12 Tactic current. The classic NFT surfaces — wash trading, counterfeit mints, royalty bypass — belong to a market structure that has contracted sharply since 2022, and a reader could reasonably conclude that NFT-specific attack classes are a historical topic. They are not; they have migrated into NFT-fi. Fractionalisation protocols, hybrid fungible/non-fungible standards, and NFT-collateral lending all exist to make non-fungible assets behave like fungible ones, and every one of those designs must maintain a correspondence between two representations of the same thing. That correspondence is a new attack surface created by the abstraction, and it does not exist in either pure market.

The two halves of this exploit are worth separating because they are separately preventable and separately common. Identifier aliasing — a value with more than one canonical form passing a check that later accounting reads differently — is the same family as the encoding-ambiguity cases OAK records at the bridge boundary (abi.encodePacked collisions, non-injective concatenation). Unchecked underflow is a solved problem with a language-level answer that this contract opted out of. The composition is what made the incident total rather than partial: the first half gets you past the door, the second creates unbounded supply once you are through. Reviewers should look for that pairing specifically in packed-storage designs, where the temptation to hand-roll arithmetic in the name of gas efficiency is highest.

The white-hat leg deserves recording on its own terms. Yuga Labs' team rescued 68 NFTs from a protocol it does not run, because its collections were the assets at risk. That is a governance development, not just a good outcome: it implies issuers of high-value collections now function as a de-facto emergency-response layer for third-party protocols that custody their tokens, with no formal relationship, no mandate, and no defined limits on what such an intervention may do. Contributors should keep an eye on this pattern — it appears alongside the BlockSec / ParaSpace rescue in 2023 and the fee-replacement defence in the 2026 Coldcard sweeps, and together they mark active third-party intervention during a live incident as an established, still-unregulated part of the response landscape.