The Sandbox states that the eligible SAND holders who were affected by the attack on the bridge on 21 August will be paid at 1:1. The payments will be made using the existing currency in the project vault and will not result in new SANDs. The project is expected to open the application within two weeks and the application window lasts two weeks.

The scope of payment is clarified

According to the ex post analysis published on 27 August, the payee was a user who had legally held a bridge version of SAND on Base or BNB Smart Chain prior to the attack. Eligible holders will receive an equal amount of SAND on the ephemeral chain.

The Sandbox states that more than 72 per cent of the eligible balances are concentrated in two centralized exchanges. This part of the user does not have to file a separate application and the relevant exchange will issue a replacement token directly to the affected customer. The remaining holders are required to submit their applications through the subsequent online application portal.

  • Damage to approximately 14.7 million SANDs
  • Based on ex post analysis prices, approximately $0.7 million
  • About 0.5% of SAND 3 billion maximum supply

The bug is in the authentication configuration

The projecter attributed the incident to the configuration of the SAND contract between Base and BNB Smart Chain. The defect enabled the attackers to acquire cross-chain information verification rights and become the sole certifiers, so that the forgery could be authorized without proper authorization.

Under these conditions, the attackers were able to forge on the target chain a SAND that was not supported by the storage assets of Taifung. After-action analysis shows that there are more than 339 trillion uncollateralized SANDs accumulated on Base and BNB Smart Chain.

The Sandbox states that this part of the unusual token has been isolated, unable to bridge back to the Ether factory or to pay for the legal reserves. The SAND deployed on the Ether and Polygon are not affected by this configuration.

The contract for the affected bridge will be disabled.

After the attack, The Sandbox decided not to resume the contract with BNB Smart Chain, but to suspend it permanently. A new contract would need to be redeployed if the bridge to the two chains were to be restored in the future, but the project has not yet given a timetable.

The bridge has been a high-profile security incident in the encryption industry. At the heart of the compensation programme, The Sandbox distinguished the bridge balance that existed prior to the attack from the collateral-free currency that was created after the attack and replaced with SAND on the Taifeng chain.

Additional information:The transaction price at the time of the ex post analysis was about $0.04 and the cumulative decline over the past seven days was about 10.4 per cent.