Collected research
Bidding Like a Billionaire - Stealing NFTs With 4-Char CSTIs
An NFT site rendered bidder names inside a Vue-mounted element but truncated them to eight characters, leaving four characters of template per bid. Many crafted names and tiny bids build an arbitrary string, reach the Function constructor, and overwrite a render helper so it is evaluated, giving XSS that fakes a huge bid the owner signs away the NFT for.
Record
- Researcher
- Matan Berson
- Published by
- matanber.com
- Date
- Topic
- Other
In the archive
Related sources
Tags
This page is the archive's own catalogue record. The research is the work of Matan Berson, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .