Yuga Labs carried out a white-hat rescue operation on June 8, recovering 68 NFTs valued at over $500,000 from Flooring Protocol after a smart contract accounting bug left the platform's liquidity pools vulnerable to exploitation. The recovered assets included two CryptoPunks, 29 Bored Ape Yacht Club NFTs, and four Mutant Ape Yacht Club NFTs, along with additional NFTs from other collections deposited into the protocol's fractionalization pools.

The Vulnerability

Flooring Protocol, a platform that enables NFT fractionalization — splitting high-value NFTs into fungible, tradeable fractions so that users can gain exposure to blue-chip assets without purchasing them outright — contained a flaw in its accounting and ownership verification logic. An attacker identified that the bug permitted the minting of near-unlimited balances of fpTokens — the protocol's internal token representing fractional NFT ownership.

The exploit allowed nominal amounts of WETH to systematically drain liquidity pools, creating a gradual extraction that could ultimately have depleted the protocol of its most valuable assets. The Flooring Protocol architect, known as 0xFreeLunch, acknowledged responsibility for the vulnerability.

How the Recovery Unfolded

Yuga Labs intervened before the attack could escalate further. The company deployed a defensive smart contract that essentially replicated the exploit's mechanics — leveraging the same broken accounting logic to mint fpTokens and extract high-value NFTs from the exposed pools before malicious actors could claim them. The approach mirrors established white-hat practices in DeFi, where security researchers and protocol teams race to front-run attackers by using the same vulnerability defensively to move at-risk funds to safety.

The operation secured 68 NFTs across multiple collections. The CryptoPunks, Bored Ape Yacht Club, and Mutant Ape Yacht Club assets represented the most valuable segment of the recovery.

All recovered NFTs remain in Yuga Labs' custody. The company has stated the assets will be returned to their rightful owners once Flooring Protocol patches the underlying vulnerability.

Broader Implications

The Flooring Protocol incident highlights ongoing concerns about the maturity of NFT-focused DeFi infrastructure. Accounting bugs — particularly errors in how protocols track token ownership and minting authority — rank among the most fundamental categories of smart contract vulnerabilities, and have been responsible for several major DeFi exploits in recent years. Comprehensive pre-deployment audits are specifically designed to identify such issues, though the complexity of composability between NFT ownership logic and fungible token minting continues to present attack surfaces that may not surface until protocols are live and holding real value.

Yuga Labs' rapid response reflects the company's direct financial and reputational stake in safeguarding CryptoPunks and Bored Ape Yacht Club holders. Yuga Labs acquired the CryptoPunks intellectual property from Larva Labs in 2022.