TokenWorks™

A playground for onchain financialized ideas. Latest project:

[TokenWorks™ @token_works]

Fake World Assets is now live™

A new way to buy and sell NFTs.

fwa(dot)fun

[TokenWorks™ @token_works]

The new FundingWorks site and contracts are now live.

[Adam @Rhynotic]

We've done a huge rework on FundingWorks: a non-speculative patron model building long lasting partnerships between creators and supporters on Ethereum.

A thread on the platform:

[Adam @Rhynotic]

Pools is now live!

Create your own pool of NFTs, buy from curated pools, and trade their tokens.

Here's what's new in the FWA ecosystem:

[Adam @Rhynotic]

Pools will be launching this Friday

Ahead of the launch, I’ve updated the FWA protocol fee split as follows:
- 56% -> Buy and burn FWA
- 16% -> Purchaser rewards
- 8% -> Depositor rewards
- 20% -> Stakers

[TokenWorksBot™ @TokenWorksBot]

PunkStrategy sold CryptoPunk #1930 for 32.9807 ETH.
Bought for 29.9825 ETH. Profit: 2.9982 ETH.

https://t.co/8ll71CWFUR

[Adam @Rhynotic]

Last night, over 1% of the FWA supply was burned as people rushed to purchase from the pool, with 2 Punks being bought for ~0.095Ξ each

At one point there were less than 50 NFTs in the pool, and already back up to 1,700!

All permissionless, fully onchain.

Fake World Assets

[Adam @Rhynotic]

Your NFTs. Your token. Your pool.

- Fill it with your NFTs and earn all of the ETH from purchases.
- Launch an $FWA paired token, route pool fees into buying and burning it, and let users spend your token on NFT purchases.
- No ETH required.

Coming soon to Fake World Assets.

[Adam @Rhynotic]

when life gives you lemons, etc.

we bought an nft from each collection and sent them to Quit's contract to allow users to swap out their NFTs easier. Half of the small swap fee buy-and-burns the Strategy token.

and I accidentally bought 2 apes, so I guess this is mine now

[TokenWorks™ @token_works]

We’ve updated the site: treat the seven affected contracts, labeled “The 7,” as using fees to buy and burn NFTs rather than relist them.

As Quit noted, the bug lets holders swap NFTs. We bought one from each collection and plan to build a tool to swap yours for one in the pool.

[Quit @0xQuit]

A quick note on this because it's maybe interesting:

These 21 apes are not truly bricked forever. They can be swapped for other apes using the same mechanism run this morning.

But all of the listings are cleared - ApeSTR effectively thinks it owns 0 apes - so nothing can be purchased.

So to you purists saying this is a deflationary event - it kind of is?

There are net-new 21 apes that can never be purchased, but which 21 those are can change from day to day.

[Quit @0xQuit]

gm gm here we go again.

This morning somebody abused a bug in ApeStr to swap 21 apes for 21 ApeStr-owned apes.

This was a known exploit (see the SQUIGSTR exploit from ~1 year ago) but incentive to run it was never there.

The bug lies in buyTargetNFT: it forces a strategy contract to send arbitrary calldata to any target. Afterwards it checks only three things: its BAYC balance rose by exactly 1, it owns expectedId, and "cost" equals its ETH balance drop.

This was patched in later NFTStrategy releases, but affects the original 6 (PunkSTR not affected).

The attacker bought 2 BAYC to use as bait. Using a helper contract, they prep the strategy contract by selling an ape to it for 5 wei and immediately buying it back for 6 wei. That primes the contract's ethToTwap with 6 wei.

They then call buyTargetNFT and pass the calldata to transfer an ape from ApeSTR to the helper using safeTransferFrom. This in turn hands execution over to the helper (remember, safeTransferFrom is NOT safe), which transfer TWO apes back to ApeSTR to satisfy the balance check (1 out, 2 in leaves ApeSTR at +1). It also calls processTokenTwap, which converts the 6 wei, setting the cost of one of the newly deposited apes to 7 wei (6 * 120%). The helper contract buys it back in the same tx.

example flow:
- Attacker has BAYC #1 and #2. ApeSTR has BAYC #3.
- Attacker "sells" BAYC #1 to ApeSTR for 6 wei and sends BAYC #2 to it for free, but steals BAYC #3 in the process.
- ApeSTR relists BAYC #1 for 7 wei, which the attacker buys.
- Attacker now has BAYC #1 and BAYC #3, and ApeSTR has BAYC #2 (but doesn't even know it).

The attacker ran this for all 21 BAYC in the ApeSTR contract, resulting in them being able to claim packs for all of those BAYC. Total net proceeds: $14k.

This previously affected SQUIGSTR because of their shared contract - any art blocks NFT sent in would satisfy the balance check, allowing the attacker to drain the contract of squiggles in exchange for basically valueless art blocks NFTs.

It was known to be possible on ApeSTR as well, so I guess it was just a matter of time before we saw it happen.

The unfortunate consequence is that now, ApeSTR has 21 apes that it is completely unaware of, so they cannot be bought from the contract. And 210 attacker-owned mudwater packs were dumped into bids.

[Adam @Rhynotic]

Looking further, it seems the exploit was fundamentally the same: a reentrancy attack allowing NFTs to be swapped that we patched in future releases, but it appears to be a worse outcome. In the process they seem to have re-bought the same NFT, clearing out the listing price.

I think this bricked the NFTs held by the Strategy since there is no longer a listing for them. I also think this can be executed on the other 6 strategies that had this bug.

This was only profitable on the APESTR contract because of the Mudwater pack claim, but there's nothing stopping someone from being unprofitable and malicious to brick the other 6 (or if there is a profitable claim in the future).

NFTs getting locked in the contract is a horrible outcome. I'm glad that this didn't happen a year ago when there was more volume on these 7 tokens, but it's heartbreaking that the issue ended up being even worse.

Let me know if you have any questions below and will do my best to answer.

[Adam @Rhynotic]

I've disabled new Strategy launches for the foreseeable future.

I don't think launches every day with zero volume helps the ecosystem, and it's better to allow communities that want the tech to launch themselves and thrive.

We've refunded all 14 pending requests. More below.

[Adam @Rhynotic]

I’m proud to announce that we’ve donated ownership of the PunkStrategy contract to the NODE Foundation.

I view the contracts we create at TokenWorks as art. NODE is already the home of the CryptoPunks IP, and I think they’re the right people to carry this idea forward. Being able to donate PunkStrategy to them means a lot to me.

With this transfer, TokenWorks’ share of trading fees will now go to NODE, giving them a new revenue stream to support artists, exhibitions, and more. We think this is the best home for the project.

PunkStrategy runs autonomously and is designed to keep running for as long as Ethereum does. At the time of writing, the contract holds 37 Punks, which remain governed by its rules. The owner can only do three things:

* Set the trading fee on the hook between 1% and 10%
* Set the relisting multiplier for newly purchased Punks between 1.1x and 10x
* Claim the owner’s share of trading fees.

We’ll continue tweeting about PunkStrategy’s buys and sells and supporting the project. Both TokenWorks and I personally remain significant holders of PNKSTR.

The Token Works

[TokenWorks™ @token_works]

If you're in Marfa, we're giving 2 free FWA purchases to 5 teams that win at Beer Pong.

Bring your A-game.

[jules @nicedayJules]

Watching @token_works fly has been a highlight of the last few years. So happy to be aligned with Adam in spirit, in goals, in morals. He is the fucking best to do it.

This year he’s supporting Marfa (again) and sponsoring the Birds Beer Garden. Adam is also donating 10 FWA spins to the first 10 winners.

Back to building these tables.
Thank you @Rhynotic

[TokenWorks™ @token_works]

We use Railway for all of our indexers and keepers. The keeper will remain offline until more information of the Railway hack is released.

We've moved funds out of our keeper wallet (1.17Ξ) in the meantime.

[Quit @0xQuit]

Railway is compromised and reports are that attackers are actively draining keys. Rotate any API keys stored in railway immediately.

Deployments are down so unfortunately this means many deployments will wind up broken, but it is better than the alternative.

Internet D-Day

[Adam @Rhynotic]

Anyone in the TokenWorks playground can start launching their ideas via the IMD swarm

Our first idea: Mutually Assured Destruction (MAD).

Will prompt a site once it builds (no trading yet). If everything works, anyone will be able to launch their own Playground tomorrow

[TokenWorks™ @token_works]

Our FWA keeper runs on Railway, and has been down for a few hours.

Railway is starting to come back online and the keeper will come back online once they're back up.

The purchase queue can still be processed manually by anyone with a transaction on the site.

[TokenWorks™ @token_works]

We’ve reinstated the 10% of protocol fees that were going to daily purchasers as ethereum:0xa0df17b5ac76ababa36e1450e2cbcd18a620c845

Protocol fees are now split as follows: 70% buy-and-burn ethereum:0xa0df17b5ac76ababa36e1450e2cbcd18a620c845, 20% to stakers, and 10% to daily purchasers

[Adam @Rhynotic]

CreditStrategy has sold 3880 NFTs for 124.876 ETH, realizing +20.813 ETH profit for the protocol.

32.3% of the ethereum:0x8e607209899b5d12bd3167a6cd0e8e11feb053d6 supply has been burned, and it still holds 10700 Credits

The Token Works

[TokenWorks™ @token_works]

6% of the FWA token supply has been burned from protocol usage.

[TokenWorks™ @token_works]

4% of the FWA token supply has been burned from protocol usage.