NFT platform Foundation fixed a smart contract problem in June 2023 that could have put NFTs created on its platform at risk. The issue involved a self-destruct function in a contract used to deploy NFT collections.
Foundation CTO Elpizo Choi announced that the issue had been fixed for contracts deployed before March 6. Contracts deployed after that date were already safe because the owner of the implementation contract had been set to zero.
The issue was first made public on June 21, 2023, by 0xngmi, co-founder of DeFiLlama. He said he had reported the problem to the Foundation about six months earlier. The problem raised concerns because one shared deployer contract was connected to many NFT collections.
This has been fixed for contracts deployed before 3/6.
Contracts deployed after 3/6 were already safe – the owner of the implementation contract was set to 0, and the contract could not have been self destructed.
— Elpizo Choi (@elpizoch) June 22, 2023
One contract created a risk for many collections
Foundation used a forwarder proxy and a shared deployer contract to reduce the cost of creating NFT collections. The design itself was meant to save users money, but the deployer contract also contained a self-destruct feature.
At the time, the deployer was controlled through a 2-out-of-6 multi-signature wallet. This meant two approved signers were needed to make changes. 0xngmi warned that if an attacker gained access to two keys, they could take control of the deployer contract.
In a GitHub article, 0xngmi said he had reproduced the attack and confirmed that the contract owner could make the NFTs unusable. He also explained that collectors who thought their NFTs were fully protected by the blockchain faced a different risk through the contracts that controlled their collections.
The problem did not mean every NFT image would simply disappear. The bigger concern was the smart contract and its metadata. If the contract were changed or destroyed, the NFTs could lose important functions or become difficult to use as intended.
Also Read: Ripple Wants RLUSD to Do More Than Move Money
Foundation’s 2026 shutdown changes the risk
Foundation later moved past the 2023 security issue, but the platform itself is no longer operating. In April 2026, Foundation announced that a planned sale of the platform to another company had failed and that the marketplace would remain offline indefinitely.
Foundation said its NFTs were built as non-custodial, on-chain assets. This means the NFTs remain in users’ wallets even though the Foundation website is offline. The company also said its smart contracts continue to exist on Ethereum.
The shutdown creates a different type of risk from the 2023 bug. Users with NFTs listed through Foundation’s contracts may need to delist them manually. Foundation also said it would maintain its IPFS gateway until April 27, 2027, giving users time to move toward other ways of storing their NFT media.
Enjoyed this? Bookmark DeFi Planet, explore related topics, and follow us on Twitter, LinkedIn, Facebook, Instagram, Threads, and CoinMarketCap Community for seamless access to high-quality industry insights.
Take control of your crypto portfolio with DEFI PLANET PRO, DeFi Planet’s suite of analytics tools.
