New Free Mint Scam: Assets Stolen After Participating in Premint Wins

Original author: Montana Wong

Original compilation: 0x9F, czgsws, BlockBeats

This article is based on the views of  Montana Wong , the co-founder of Web3 creator tool application  Sprise and Pally.gg, on his personal social media platform, and BlockBeats organizes it The translation is as follows:

"degen meta" is the current Trend, teams start projects in the form of Free Mint, with little or no project roadmap provided, this form is used by such as goblintown  ; Wait for the success of the project to bring fire. This pattern is fine in a bear market because Free Mint at least doesn't lose money.

Cheaters take advantage of this. Instead of creating fake projects to defraud your ETH, they create a FOMO atmosphere to induce you to participate in the free "degen" Mint project, and trick you into granting them permission to transfer NFT in your wallet.

Usually they start by using a legitimate service like Premint to draw prizes for their pre-sale list. Premint does not do any review of projects using their service, but many people don't know this and think that these sweepstakes are "premint-endorsed."

To make matters worse, Premint allows sweepstakes creators to impose certain requirements, such as "must hold 1 Moonbirds NFT" to participate. This can create a fake lottery that pretends to be officially recognized without the consent of the original project party.

During the "White List Pre-Sale", you will still participate in the wallet with high-value NFT Minted, as they are required for the initial entry into the sweepstakes. This is where your NFT can be stolen, let's see how this works.

There is a new version of this scam today "aLL tHiNg bEgiNs", leading to the theft of several high-value Moonbirds NFTs.

If you go to their website it looks like a typical rotten Free Mint Project, with options to connect wallet and Mint. But once you dig deeper, you will find that this website is by no means so simple.

The first thing you can notice is that a lot of their site's code is copied from goblintown site.

Secondly, if you look at the JavaScript on the page, there's a file called signupxx44777.js, and that's where the vulnerability is.

Once the wallet is connected, the code kicks in, literally "drain NFTs". However, the real purpose of the code is:

1. Browse the content in your address < /p>

2. Use OpenSea's API to determine which is your most valuable NFT 

3 . Identify your most valuable NFT and find its smart contract information

4. Once you click "mint", it will generate a transaction with you The contract of the most valuable NFT interacts, and this setApprovalForAll transaction will grant the scammer the authority to transfer your NFT away

So while you think you're just executing a typical Free Mint transaction, you're actually allowing scammers to transfer your most valuable NFTs from your wallet, plain and simple.

In summary, this exploit works as follows:

< br>

1. Create hype around the free Degen Mint project, using legitimate tools like Premint to lure high-value wallets to participate

2. Create a website with malicious JavaScript that scans your wallet for the highest value NFT

3. The fake Mint option will not actually generate a Mint transaction, but will create a malicious transaction that grants the scammer to transfer your NFT  permission

4 . Repeat steps 1-3 under different "items" with the same code

These scams Most of them may be made by one person, so we must pay attention to safety. If you think you have been affected by one of these scams, you can revoke access to all NFTs of value at revoke.cash  , or transfer them to a hardware wallet as soon as possible.

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia