How Mad Lads Tricked Bots Into Spending $250K on Fake NFTs

NFT

Mad Lads is the talk of the NFT world right now, becoming the buzziest mint for any profile picture (PFP) project in months and topping the broader market this weekend. But the drop itself proved dramatic, as bots overwhelmed the mint and forced a 24-hour delay.

However, the “Mad Lads” behind the project lived up to its namesake and fought back, tricking schemers into spending over $250,000 worth of SOL on a fake mint. It was all refunded, but the move apparently kept more of the NFT drop supply for people who actually wanted to be part of the project—and away from those who were trying to mint as many NFTs as possible as a quick flip for profit.

“We decided that we had to battle the botters,” Coral CEO Armani Ferrante told Decrypt, “and we had to do it for the sake of the project.”

HONEYPOT BITCHhttps://t.co/6Q91RAQigh

— Mad Lads (@MadLadsNFT) April 21, 2023

Ferrante said that as the mint neared early last week, he began receiving Telegram messages from an unknown party who attempted to extort Coral, claiming that they could “take down” Coral’s Backpack app and botch the drop.

According to Ferrante, the person effectively threatened a distributed denial-of-service (DDOS) attack to overwhelm the mint with requests, and demanded payment to stand down.

Solana NFTs Come to Portfolio App Floor Amid Mad Lads Boom

“We didn’t have the money. We’re strapped on cash—we’re fighting to survive,” Ferrante said, referencing that over 70% of the funds that Coral raised in its $20 million strategic round last fall are inaccessible due to FTX’s collapse.

But Ferrante also described the dilemma as more than just a financial one—it was a fight for the future of the project, to build an organic community of collectors that took part in the mint.

Mint mayhem

High-profile NFT mints are often targeted by users wielding bots, or automated programs that flood the mint program with requests and try to purchase an inordinate amount of assets. It’s usually done to flip on the secondary market amid the post-mint buzz.

Bot attacks tied to NFT drops have taken down the Solana network in the past, but even when the tech is running smoothly, a bot-dominated mint means that would-be collectors and users with a true affinity for the project are sometimes unable to mint. Curated allowlists of authorized wallets can help, but introduce their own inequities into the minting process.

Mad Lads held an allowlist mint on Wednesday, and all went according to plan. But when the public mint for the rest of the NFT supply was about to begin on Thursday, Ferrante said that the DDOS attacks began immediately.

The Mad Lads mint was briefly postponed multiple times on Thursday as Coral tried to mitigate the attacks. The Solana network stayed online, but other hitches emerged as RPC providers had issues and CoinGecko’s pricing API went down. Ferrante described it as a “domino effect” as “billions of requests” were pointed at the Mad Lads mint and started wreaking havoc.

“There was basically this cat-and-mouse game that started happening where the attacker was trying to reverse-engineer their code,” Ferrante told Decrypt, “and we would change the antibody tactics and go back and forth, and back and forth.”

Billions of requests. Things that went wrong.

– crushed by ddos (and extortion)
– coingecko api down
– twitter spaces broken
– cloudflare ui broken
– rpc node 1 data center rugged
– rpc node 2 unable to handle capacity
– bots trying to rug the public phase

Fock it.

— Mad Armani 🎒 (@armaniferrante) April 21, 2023

Coral eventually pushed the mint by 24 hours until Friday night, instead of simply going ahead and letting botters claim an unfair share of the NFTs. Ferrante’s team spent the extra time working out how to better protect against botting attacks—including a new kind of strategy.

Into the honeypot

As the Friday mint was about to start, the DDOS flood began anew. This time around, Coral sent two back-to-back updates to the minting app: one that was legitimate and pointed to the real NFT mint process, as would be referenced in the public mint interface, and another that could only be found by reverse-engineering the code.

That one pointed to a “honeypot”—effectively, an isolated distraction designed to trick botters into blowing their SOL on a fake mint and receiving nothing valuable in the process. The fake contract soaked up over $250,000 worth of SOL, and those users who tried to gain an unfair edge in the mint weren’t in the mix when the legitimate public NFT drop began moments later.

“HONEYPOT BITCH,” the Mad Lads project tweeted Friday, pointing to a Solana network account that held the funds pulled from the faux mint.

Ferrante told Decrypt that it’s possible that some legitimate users got caught up in the fake mint. Some users on Twitter said that they were following the rules and ended up with a useless NFT, although in the pseudonymous Web3 world, it can be difficult to vet the legitimacy of complaints on social media.

Thanks for playing.

We’ll be returning all SOL in the honeypot by the end of the day. https://t.co/Xj4NBRYnrd pic.twitter.com/H1GO1pMZaC

— Mad Lads (@MadLadsNFT) April 22, 2023

Even so, Ferrante said he’s confident it was mostly users who were trying to game the mint. That’s because minters would have had to manually create code to mint the NFTs after reverse-engineering the contract code, he said, thus pointing to more sophisticated users going outside of the normal process.

Ultimately, the honeypot move was designed to distract and thwart botters and not steal away funds—so refunds were processed hours after the mint concluded.

BREAKING: @MadLadsNFT 24H NFT SALES VOLUME IS LARGER THAN THOSE OF THE NEXT 9 COLLECTIONS COMBINED – $8,167,746 VS. $7,781,155 pic.twitter.com/0tVbY129tN

— DEGEN NEWS 🗞️ (@DegenerateNews) April 22, 2023

Whether this type of strategy will work again for future NFT drops is unclear, as the cat-and-mouse game continues. But Ferrante believes that the surprise tactic helped Mad Lads reach more of its intended audience, and the drama and excitement arguably helped fuel buzz around the project as it topped the NFT charts over the weekend.

“In real time, we were fighting these guys that were trying to extort us at the beginning of the week,” Ferrante concluded. “And it was kind of this very euphoric, crazy event. It was honestly one of the most stressful times in my life.”