OAK-T12.008 — Hybrid Fungible / Non-Fungible Standard Accounting Divergence

Description

A class of exploits against contracts that maintain two representations of the same asset simultaneously — a fungible ERC-20 balance and per-tokenId non-fungible ownership — and must keep them in agreement. This is the defining property of the ERC-404 / BT404 hybrid token family and of NFT fractionalisation protocols, where depositing an NFT mints fungible units and burning enough fungible units redeems an NFT.

The vulnerable surface is neither representation. It is the seam: the code that keeps Σ fungible supply consistent with escrowed token count, and that decides which tokenId a given fungible position corresponds to. Two properties of hybrid implementations make that seam unusually fragile:

1. Packed storage. Hybrids routinely pack ownership, index, and balance data into shared slots for gas efficiency. Packing creates identifier representations with more than one reading — a crafted value (a high-bit alias, an out-of-range index, a reserved-bit encoding) can satisfy one accessor while resolving differently in another. When the first accessor is an authorisation check and the second is accounting, the result is what public analysis of the anchor case called "ghost ownership": the check believes you own a token you do not.
2. Bidirectional mint/burn on every transfer. Because a fungible transfer can implicitly mint or burn NFT-side state (and vice versa), balance mutations happen on paths that a reviewer reads as simple transfers. Unchecked arithmetic on any of them — an underflow on a subtraction that should have reverted — creates supply out of nothing, and the hybrid design guarantees there are many such paths.

Composed, the two produce the anchor's shape: get past an ownership predicate with an aliased identifier, then underflow a balance update, converting a trivial deposit into a near-unbounded fungible balance which is redeemed for real NFTs.

The class is filed under T12 rather than T9 because the seam exists only because the asset is non-fungible. A pure ERC-20 has one representation and no correspondence to maintain; a pure ERC-721 has no fungible supply to diverge. The vulnerability is created by the abstraction that makes NFTs tradeable as fungible units, which is precisely the T12 boundary rule: the attack targets the NFT layer and the assets at risk are the collection's tokens.

Contagion is a defining secondary property. Hybrid implementations are heavily forked — the standards are young, the reference implementations are shared, and the gas-optimised packing is copied wholesale. A defect in one deployment is a defect in its fork population on day one, and disclosure of the original is a disclosure against every fork that has not patched (see OAK-T9.007).

Observed indicators

• A deposit or transfer whose output balance is disproportionate to its input within a single transaction — small quote-asset in, enormous fungible-token out.
• Σ fungible supply diverging from escrowed NFT count × fraction size, at any point, by any amount.
• Ownership checks succeeding for callers who do not appear as owner in the collection's canonical view.
• Token identifiers with high-bit set, out-of-range, or otherwise non-canonical encodings appearing in call data.
• Redemption of underlying NFTs by an address whose fungible position was created in the same transaction block as the redemption.
• Attack transactions replayed against forks of the affected implementation shortly after public disclosure.

Detection signals

• Cross-representation invariant as a hard runtime check — the single highest-value control. Σ fungible supply ⟷ escrowed token count must be asserted continuously, not documented as an assumption. It catches every seam bug, including ones with no name yet.
• Deposit-to-mint ratio bounds inside the transaction, so a disproportionate mint reverts rather than alerting after the pools are gone.
• Identifier canonicalisation checks at every authorisation boundary: reject high-bit, out-of-range, and duplicate-representation identifiers before any ownership predicate reads them.
• Ownership cross-check against the canonical collection contract's ownerOf where the hybrid maintains its own ownership view.
• Fork-population monitoring: on disclosure of a hybrid-standard defect, enumerate known forks and alert on unpatched deployments — the contagion window is measured in days.

Real-world examples

• examples/2026-06-flooring-protocol-bt404-ghost-ownership-underflow.md — Flooring Protocol V2 / BitmapPunks — Ethereum — 2026-06-08 (canonical anchor). Initial loss reporting above $900K; a Yuga Labs-linked white-hat team rescued 68 NFTs valued at over $500K, with BAYC and CryptoPunks assets exposed. A malicious high-bit token-ID alias satisfied an ownership check while later accounting resolved differently ("ghost ownership"), and an unchecked balance update underflowed, so a small WETH deposit produced a near-unlimited fpToken balance used to drain pools and redeem the underlying NFTs. The fork Asterix was exploited on the same unfixed logic after disclosure (T9.007).

Pipeline anchors

• Rugged Art (ERC-404) — reentrancy, 11 ETH ($32K). Logged in SlowMist's NFT incident registry; a second data point for the hybrid-standard population, currently too thin for a worked example. A write-up would move this Technique toward emerging.
• The wider NFT-fractionalisation population (μToken / fpToken-style designs) carries the same seam by construction and is the expected source of the second independent anchor.

Reference implementations

• mg-detectors-rs — coverage gap. The controlling invariant is protocol-internal.
• Checked arithmetic (Solidity ≥ 0.8 default) — the second half of the anchor exploit is an opt-out from the language's own protection.
• ERC-404 / BT404 reference implementations — the shared substrate whose packing strategy defines this surface, and the reason the fork population inherits defects.

Mitigations

• Assert the cross-representation invariant at runtime, on every path that mutates either side. This is the control that bounds the class independently of which seam bug is present.
• Canonicalise and bounds-check identifiers before authorisation — no value may have two valid readings.
• Never opt out of checked arithmetic on balance mutation, regardless of the gas argument.
• Bound mint-per-deposit ratios so a seam failure produces a bounded rather than unbounded position.
• Treat disclosure as a fork-wide coordination event, with an enumerated fork list maintained in advance.

Citations

• See examples/2026-06-flooring-protocol-bt404-ghost-ownership-underflow.md for the full citation set.

Discussion

T12.008 is observed under VERSIONING.md: field-confirmed at a single anchor, awaiting the breadth of independent attestation that emerging requires. It is worth minting now rather than holding as a gap candidate because it names the surface that has replaced the 2021–2022 NFT attack classes. Wash trading, counterfeit mints, and royalty bypass describe a market structure that has contracted; the live NFT attack surface has migrated into NFT-fi — fractionalisation, hybrid standards, and collateral lending (T12.006) — all of which exist to make non-fungible assets behave fungibly, and all of which create correspondence obligations that neither pure asset type has.

The class also generalises a lesson OAK records at the bridge boundary. Identifier aliasing — a value with more than one canonical form passing a check that later logic reads differently — is the same defect family as the abi.encodePacked collision at MAP Protocol (2026-05) and the non-injective field concatenation at Wanchain (2026-07). Different domains, identical root: an encoding that is not injective, consumed by code that assumed it was. Contributors encountering a case where the same bytes meant two things to two readers should look for that framing regardless of which Tactic the incident lands in.

Finally, the contagion property should shape how disclosure is handled for this family specifically. Hybrid implementations are copied more than they are written, and the anchor case shows the fork being exploited after the original was public — the disclosure itself supplied the map. Any coordinated-disclosure plan for a hybrid-standard defect should treat the fork population as part of the affected party set from the first hour, not as a follow-up.