The vulnerability in the digital collectible contract has led to $34 million in assets being locked. Experts urge attention to security audits.

Recently, a security company discovered two serious vulnerabilities in a certain digital collectible contract, which could result in user assets being locked or the project party's funds being unable to be withdrawn.

The first vulnerability is located in the refund processing function. This function uses a loop to process refunds for all users, but if the refund target is a malicious contract, it may refuse to accept and cause the transaction to fail, thereby affecting the refund operations for all users. Fortunately, this vulnerability has not been exploited.

For refund scenarios like this, experts recommend taking the following security measures:

1. Only regular user accounts are allowed to participate in the project.
2. Use tokens (such as WETH) instead of native assets
3. Design a mechanism for users to actively claim refunds to avoid bulk refunds.

The second vulnerability is a code error. In the function for the project party to withdraw funds, there is a conditional judgment bug. This judgment should compare the refund progress with the bid index, but it incorrectly compares with the total number of bids. Since the refund progress is always less than the total number of bids and does not increase anymore, the condition is never satisfied, causing the project party's funds to be permanently locked in the contract. Currently, over $34 million worth of assets are locked.

This incident once again highlights the importance of project security. Even well-known projects can make basic mistakes. The development team needs to write sufficient test cases and cultivate a fundamental awareness of security. Although security audits have become a routine practice in the decentralized finance field, there are still shortcomings in digital collectibles projects, which led to significant losses in this incident.

This event reminds us that regardless of the size of the project party, we should pay attention to the security of smart contracts and conduct comprehensive security audits to prevent similar issues from occurring.