Asterix Protocol Inherits $40K Flaw From Flooring’s June Hack

Published by James Harris on June 9, 2026June 9, 2026

A forked NFT liquidity protocol called Asterix lost roughly $40,000 early Wednesday after attackers used the same vulnerability that drained Flooring Protocol on June 8, exploiting code Asterix had copied directly from the DN404/BT404 token standard without catching the underlying flaw.

The attack vector, identified by BlockSec’s Phalcon, centers on what Yuga Labs’ VP of Blockchain described as “ghost ownership”: a flaw in BT404-style accounting that lets a single malicious token ID satisfy one ownership check and then produce a different result in a second accounting pass, effectively manufacturing an infinite balance of the fungible tokens used to redeem locked NFTs. Flooring Protocol, which shut down last year, had built its entire NFT liquidity model on this mechanic, and any fork that inherited the code inherited the bug. Yuga Labs moved quickly on the original breach, running a white hat recovery that secured 68 NFTs worth roughly 346 ETH before a second attacker could reach them, including 29 Bored Apes and two CryptoPunks. Asterix did not have that safety net. FreeLunchCapital confirmed the same attack path also hit BitmapPunks, which used a comparable contract design, and SSR warned users away from its own pool after seeing what happened.

The forked code problem is not new, but it rarely plays out this cleanly as a chain of sequential victims.

This incident sits inside a broader deterioration in Web3 security metrics. Certik counted 60 confirmed incidents in May alone, totaling $68.3 million in losses, and PeckShield attributed $340.7 million to bridge and cross-chain exploits through June 1. For NFT liquidity protocols specifically, the Flooring case illustrates a structural risk that tends to get underweighted: when a base contract is copied across multiple projects, a single audit failure becomes a sector-wide exposure, and the projects with the smallest treasuries or least active development teams are typically the last to patch. Asterix’s $40,000 loss is small relative to the Flooring incident, but the team has not disclosed whether any recovery is possible, which matters to holders trying to assess whether the $ASTX token contract is effectively dead.

Yuga Labs said recovered NFTs from the Flooring rescue will be returned once developers complete a patch, and 0xQuit has warned users against depositing new NFTs into Flooring pools in the interim. Whether Asterix publishes a credible post-mortem will be the first real signal of whether the project has the capacity to continue operating at all.