Asterix
@asterixlabs was reportedly attacked a few hours ago, with a loss of ~$40K. The root cause appears similar to yesterday’s Flooring incident, which had a total impact of $900K , with ~$500K rescued by white hats.
Asterix appears to be forked from Flooring, and DN404/BT404 appear to share essentially the same 404-style ERC20/ERC721 hybrid contract design under different names/variants.
The shared root cause appears to be a high-bit NFT ID shift/overflow issue, leading to ID reuse and broken ownership/approval/accounting breakdowns (underflow).
Specifically, full uint256 NFT IDs enter external functions, while ownership/accounting is stored in packed lower-width slots. Crafted IDs with different high bits but colliding low bits can desync ownership, approvals, balances, and NFT backing. The attacker can then abuse exchange/transfer/unwrap flows to inflate the fungible token balance, sell into liquidity pools to drain WETH, and potentially extract additional value from backed NFTs.