Sandbox Bridges Contain Unbacked SAND Mint on Base and BSC
The Sandbox has contained a bridge exploit that allowed an attacker to mint unbacked SAND on Base and BNB Smart Chain. The studio behind the virtual-world game said it identified and fully contained the vulnerability in the SAND cross-chain bridge, but bridging to and from both networks is now switched off, isolating the SAND on those chains.
No user wallets were compromised, but the liquidity on those networks is compromised. The Sandbox said users should not buy, sell or trade SAND on Base or BSC due to the compromised liquidity. It also warned that SAND's price volatility could widen due to the incident.
The attacker hijacked LayerZero delegate permissions through a function called `approveAndCall` on SAND's omnichain fungible token contract on Base, according to security firm Blockaid. The attack was still ongoing when Blockaid described the mechanism hours earlier.