OAK-T12.007 — Mint-Outcome Reroll (Revert-Until-Rare)

Description

A class of attacks against the fairness of an NFT distribution rather than against custody or accounting. The attacker mints from a contract instead of an externally-owned account, inspects the outcome inside the same transaction, and reverts whenever the result is not valuable enough — repeating until a rare token is obtained. Nothing is stolen; the collection's scarcity, which is the entire economic proposition being sold to buyers, is quietly redistributed to whoever automated the loop.

Two preconditions must both hold, and the class disappears if either is broken:

1. The outcome is knowable before the transaction is final. The minted tokenId — or a rarity-bearing attribute derived from it — is returned or readable within the minting transaction.
2. The outcome is mapped to value at mint time. A published attribute table, an on-chain metadata call, or a leaked / archived rarity file lets the attacker score the result immediately.

Because EVM transactions are atomic, an unfavourable draw costs only gas. The attacker's loop is: mint() → read the result → require(rarity ≥ threshold) → otherwise revert the entire transaction as if it never happened. The distribution the project believed it was running — a lottery — becomes a filtered search run by whoever has the tooling, at a cost the project never priced.

This is distinct from its neighbours in the T12 family. T12.002 (Fake-Mint / Counterfeit Collection) produces a token from a collection that is not what it claims; here the token is entirely genuine and the collection contract behaves as written. T12.001 (Wash-Trade Volume Inflation) manipulates the market signal after issuance; here the manipulation happens at issuance. It is also not an oracle or randomness-compromise case in the T9 sense: the randomness may be perfectly sound, and the attack still works, because the flaw is not how the number is drawn but when the drawer learns it relative to when they must accept it.

Observed indicators

• Mint transactions originating from contracts rather than EOAs, especially newly deployed ones with no other purpose.
• A high revert rate concentrated on a small number of minter addresses during a public mint — the loop's failed iterations are visible on-chain as reverted transactions burning gas.
• Post-mint rarity distribution that is statistically skewed toward a small set of holders relative to a fair draw — the outcome signature, detectable even when the reverted attempts were not monitored.
• Publication (or archival availability) of a per-tokenId attribute file before or during the mint window.
• Immediate listing of a top-rarity token by a wallet whose only prior activity is minting.

Detection signals

• Revert-rate-by-sender during an active mint: group mint-function calls by tx.origin / sender and alert on senders whose failed-to-successful ratio exceeds a threshold. This fires while the mint is running, which is the only window in which a project can still act.
• Contract-caller detection on the mint entrypoint (msg.sender != tx.origin, or non-empty extcodesize), reported rather than necessarily blocked — a signal, not a security boundary, since it is bypassable from a constructor.
• Rarity-concentration test post-mint: compare the realised rarity distribution per holder against the expected distribution for a fair draw; a significant skew is the durable evidence that survives even if nobody watched the mempool.
• Attribute-file exposure check pre-mint: determine whether per-tokenId attributes are reachable — via IPFS listing, a sequential-URI walk, a repository, or an archived asset — before the mint window opens.

Real-world examples

• examples/2021-05-meebits-mint-outcome-reroll-rarity-exploit.md — Meebits / Larva Labs — Ethereum — 2021-05-08 (canonical anchor). The Meebits contract's minting path let a caller learn the minted token's identity within the transaction, and an archived file carrying per-tokenId characteristics let the attacker score it immediately. A contract that minted, checked the result against a rarity list, and reverted below a threshold produced an ultra-rare Meebit that sold for 200 ETH (~$700K–765K). The attacker, operating as 0xNietzsche, publicly claimed an anticipated rate of "$300,000 per hour" for the duration of the window. Larva Labs paused community minting and trading and moved distribution to a devMint flow gated on proof of Punk / Glyph ownership. No user's assets were taken and the contract was never compromised — the loss was borne by every buyer who paid for a fair lottery.

Reference implementations

• mg-detectors-rs — coverage gap. Revert-rate-by-sender during a mint window is a mempool/transaction-stream analytic rather than a state-based detector.
• Chainlink VRF — the canonical randomness source for mint assignment; note that VRF alone does not close this class if the resulting tokenId is still mapped to known attributes inside the same transaction.
• Delayed-reveal / post-mint shuffle patterns — the structural fix, widely adopted after 2021 and documented in Paradigm's NFT-launch design work.

Mitigations

• Delayed reveal (the load-bearing fix): assign tokenIds at mint but bind attributes only after the mint window closes, via a single shuffle seeded by a value nobody could predict during minting. If rarity is unknowable at mint time, there is nothing to filter on.
• Commit-reveal minting: the minter commits in one transaction and receives the token in a later one, so the outcome cannot be rejected by the party who learns it.
• Never publish or stage per-tokenId attributes before reveal, including in repositories, IPFS directories with enumerable listings, or build artefacts. The Meebits case turned on an archived attribute file, not on a contract flaw.
• Instrument the mint window: revert-rate-by-sender alerting, with a pre-agreed decision on whether to pause. Larva Labs' pause was the correct move and it came after the fact.
• Treat contract-caller blocking as a speed bump, not a control — it is bypassable and it penalises legitimate smart-contract wallets.

Citations

• See examples/2021-05-meebits-mint-outcome-reroll-rarity-exploit.md for the full citation set.

Discussion

T12.007 is observed rather than emerging: the pattern is field-confirmed at a single public anchor with an unusually complete record — the attacker narrated the technique publicly, the resulting token's sale price is on-chain, and the vendor's remediation is documented — but a second independent anchor with comparable documentation has not been written up. The class is almost certainly under-reported rather than rare. Every collection that revealed attributes at mint time between 2021 and 2022 carried the precondition, and the evidence of exploitation (reverted transactions) is exactly the kind of on-chain artefact that nobody archives and most explorers de-emphasise.

The deeper reason to name the class is that it is the clearest example in the corpus of an attack with no victim in the accounting sense and a real victim in the economic sense. Nobody's wallet was drained. The contract did what it was written to do. Yet the product being sold — a fair shot at a scarce edition — was consumed by one party before the buyers ever had it, and the price the buyers paid was set on the assumption that it had not been. Frameworks that classify only by asset movement miss this entirely, which is why OAK files it as a Technique rather than as a market curiosity.

Finally, the mitigation story here is a genuine ecosystem success worth recording alongside the failures. Delayed reveal went from an unusual design choice in early 2021 to near-universal practice by 2022, and the mechanism was retired largely because the precondition was designed away rather than because attackers stopped trying. Contributors documenting new mint mechanics — hybrid fungible/non-fungible standards, on-chain generative art, loot-box and gacha redemption paths — should check the two preconditions explicitly, because novel issuance designs keep re-introducing atomic knowability without recognising it as the same hazard.