In Brief:
- TokenWorks said it found a bug in eight deployed NFTStrategy contracts that lets an NFT held by the protocol be swapped for a different token on the same contract. PunkStrategy isn’t affected.
- The bug surfaced after an attacker swapped Squiggles out of SquiggleStrategy for lower-value Art Blocks pieces on the same contract. TokenWorks said SquiggleStrategy now works as a “Day One AB” strategy.
- TokenWorks said funds are safe and the strategy tokens don’t need to be redeployed. The five strategy launches it had planned are delayed a few days.
TokenWorks has found a bug in eight of its deployed NFTStrategy contracts. The team said it lets someone swap an NFT the protocol owns for a different NFT on the same contract without the protocol knowing.
The team found the bug while investigating an exploit on SquiggleStrategy. PunkStrategy is unaffected. “TL;DR Everything is safe. All new strategies will be protected,” TokenWorks said on X.
TL;DR Everything is safe. All new strategies will be protected. Original eight strategies (minus PunkStrategy which is unaffected) have slight mechanical twist that lends itself to SquiggleStrategy being functionally reworked as 'Day One AB'.
Yesterday we found a bug in the 8…
The five strategy launches TokenWorks had planned are on hold. “Future strategy launches are delayed for a few days until we feel the contracts are secure,” the team said. “The 5 planned launches will resume afterwards.”
What happened to SquiggleStrategy
On Sept. 28, 2025, TokenWorks said it was “actively investigating an exploit on the SquiggleStrategy contract.” It said all other strategies were unaffected at the time.
The attacker swapped Chromie Squiggles held by the strategy for lower-value NFTs from the same Art Blocks contract: Genesis by DCA and Construction Token by Jeff Davis. Squiggles share that contract with other Art Blocks projects, which made the swap possible.
Punks Fanatics, a community member, said: “I think the issue is solely with Squiggles, due to the Art Block contract. This happened before on OS.”
The wider bug
While looking into the Squiggle exploit, the team found the same flaw in the other strategies. It said there is “a complex way of swapping out an NFT owned by the protocol with a different one on the same contract.”
For most collections, swapping one floor NFT for another looks harmless. The protocol’s records are where it breaks. “So if Bored Ape #2516 was listed at 15e and swapped with Bored Ape #2517 (#2516 is no longer held in the protocol and #2517 is in the protocol), the ape the protocol holds is not listed for sale essentially “bricking” it,” TokenWorks said.
The team said the bug hadn’t been exploited outside SquiggleStrategy and wouldn’t pay off for an attacker. It said it acted anyway to head off a possible denial-of-service attack while the strategies are still new.
A “call option” on bricked NFTs
TokenWorks said the swap also works in reverse. Someone can put the exploited NFT back into the protocol, which relists it at the intended price, and take out one of the “bricked” NFTs.
“This means at any point in the future, the exploited NFT can be sold by the protocol as intended for the listing price,” the team said. “This essentially creates a sort of “call option” on the NFT.”
If floor prices rise above a listing price, the team said a rational trader would swap the exploited NFT back, buy it from the protocol and keep the difference between the price and the current floor. That would release the ETH and restart the buy-and-burn.
TokenWorks named one downside. “The only downside we could find from this is if someone finds their “Forever NFT” and wants to hold on this specific token, the ETH will remain in there until then and may never unlock,” the team said.
TokenWorks said it will “eventually build a frontend” to help holders of exploited NFTs swap them back, which it called exercising the call.
SquiggleStrategy becomes “Day One AB”
For SquiggleStrategy, the team said the mechanic means “all 11,012 NFTs on that contract essentially being treated equally.” It now calls the product a “Day One AB” strategy.
TokenWorks gave two reasons it finds the change interesting. Squiggles by Snowfro, Genesis by DCA and Construction Token by Jeff Davis launched together on Art Blocks’ first day, and many collectors already collect them as a set.
The team’s second point was edition size. Genesis has 512 editions and Construction Token has 500, against 10,000 Squiggles. TokenWorks said the two smaller collections “are only ~30% off the value of an individual Squiggle.”
Funds and tokens
TokenWorks said the ERC20 tokens have no issues and fees will keep pooling to buy floor NFTs. It said ETH held in the affected NFTs is safe, though its return to the LP through buy-and-burns may be delayed. The strategy tokens “do NOT need to be redeployed,” the team said.
Background
TokenWorks launched NFTStrategy on Sept. 20, 2025. It extended the PunkStrategy ($PNKSTR) model to Bored Ape Yacht Club, Pudgy Penguins PENGU $0.007719 ▼ -3.4%, Moonbirds, Meebits and CryptoDickbutts.
PunkStrategy charges a 10% swap fee to build an ETH treasury. It uses that treasury to buy the cheapest CryptoPunk, relists the Punk at 1.2 times its cost and uses sale proceeds to buy and burn $PNKSTR.
TokenWorks later said it would add a new strategy every day for a week. The list included Chromie Squiggles, CrypToadz, Goblintown, Checks, Max Pain by XCopy, Good Vibes Club and Milady.
The team closed its post with this line: “Thank you all for the support, and every bump in the road makes us stronger.”
