The Sandbox, one of the most recognizable blockchain gaming platforms, has publicly committed to making affected users whole after a bridge exploit drained millions of SAND tokens from an Ethereum vault. The company said eligible holders who had bridged SAND on Base or BNB Smart Chain before the attack will receive a 1:1 repayment in Ethereum-based SAND from its treasury, with claims expected to open within two weeks.
Repayment plan and claim window
According to a post-mortem published on Thursday, The Sandbox will compensate users who legitimately held bridged SAND on Base or BNB Smart Chain prior to the exploit. Eligible holders will receive an equal amount of Ethereum-based SAND, the native token of The Sandbox ecosystem. The company stressed that the compensation will be drawn from its treasury and that no new tokens will be minted as part of the repayment process.
The claims process is expected to open within two weeks and remain open for another two weeks. The Sandbox also revealed that two centralized exchanges currently hold more than 72 percent of the eligible balances. Those exchanges will distribute compensation directly to their affected customers, reducing the burden on individual users to file standalone claims.
What went wrong
The exploit occurred on Aug. 21 and resulted in the loss of approximately 14.7 million SAND, worth around $700,000 at the time. The attacker targeted a vulnerability in SAND's bridge contracts on Base and BNB Smart Chain. The Sandbox explained that a configuration flaw allowed the attacker to become the sole verifier of incoming bridge messages. This elevated level of control made it possible for the attacker to mint unbacked SAND tokens on the two networks.
The project said that more than 339 trillion unbacked SAND tokens were minted during the attack. While that number sounds staggering, those tokens have been isolated and cannot be bridged or redeemed. SAND on Ethereum and Polygon was unaffected by the exploit. The 14.7 million drained tokens represent roughly 0.5 percent of SAND's 3 billion maximum supply
Source: Cointelegraph News