A few security vulnerabilities have been discovered in Obyte City and Obyte Friends. Your funds are safe, but Friends participants need to perform a few simple steps to withdraw their funds from the old Friends – see below.
Obyte City
Obyte City has been relaunched with a new, fixed AA. A new CITY token has been issued and already distributed to the existing holders 1:1. If you had the old CITY at ODEX, that balance has also been accounted for. The new token’s name is initially CITY_NEW. It will be renamed to CITY in 30 days and the old token will be renamed to CITY_OLD. Technically, you’ll still own the old tokens, but they’ll be worthless.
All your plots and houses have been copied over to the new city and it looks exactly the same as the old one. No action is required from your side.
The vulnerability was in the rental function of the old city. The old AA allows renting negative areas, which enables attackers to issue unlimited amounts of the old CITY tokens. This was fixed in the new AA.
Obyte Friends
Obyte Friends has also been relaunched. It’s operated by a new AA and has a new token. The new Obyte Friends starts with a clean slate, so you have to lock funds and make friends again. Sadly, due to the relaunch, old friends and rewards in FRD are lost in the new version. The new token is initially named FRD_NEW but will be renamed to FRD in 30 days, while the old token will be renamed to FRD_OLD –and it’ll be essentially worthless.
The vulnerability was in the unlock date for extremely long locking terms. After year 10,000, the ISO8601 dates look like “ 10000-01-01” and the “ ” sign makes them sort before the present dates (which look like “2026-01-01”), making such deposits instantly withdrawable. This allows attackers to cyclically deposit and withdraw, while earning referral fees for the referrer every time and inflating FRD supply. That’s why we needed to migrate to a new AA.
To withdraw your GBYTE/USDC/ETH locked in the old Friends, please contact us. We'll use this vulnerability to mint the old FRD for you (or you can do so yourself). Then, you will use the “replace” function to lock this FRD and release your locked tokens before your unlock date. The replace function is available on your profile page of the old Friends website
oldfriends.obyte.org. After releasing the tokens, you can lock them again on the new Friends website
friends.obyte.org.
We're sorry for the inconvenience caused by this migration process. Fortunately, we avoided any losses from the bugs.
Now, please start using the new, strengthened versions of these apps to rebuild our community. Another community building app is coming soon. Stay tuned!