In Brief:
- TokenWorks found a flaw in eight live NFTStrategy contracts. It allows an NFT owned by the protocol to be traded out for another token from the same contract. PunkStrategy is not affected.
- The flaw came to light when an attacker pulled Squiggles out of SquiggleStrategy and replaced them with cheaper Art Blocks pieces from the same contract. According to TokenWorks, SquiggleStrategy now operates as a “Day One AB” strategy.
- TokenWorks says funds are safe and the strategy tokens won’t need redeploying. Its five planned strategy launches have been pushed back a few days.
Eight of TokenWorks’ deployed NFTStrategy contracts contain a bug, the team has disclosed. It said the flaw makes it possible to exchange an NFT the protocol owns for another NFT on the same contract, and the protocol doesn’t register the change.
The discovery came during an investigation into an exploit on SquiggleStrategy. PunkStrategy isn’t affected. On X, TokenWorks wrote: “TL;DR Everything is safe. All new strategies will be protected.”
TL;DR Everything is safe. All new strategies will be protected. Original eight strategies (minus PunkStrategy which is unaffected) have slight mechanical twist that lends itself to SquiggleStrategy being functionally reworked as 'Day One AB'.
Yesterday we found a bug in the 8…@token_worksView on X ↗
All five of TokenWorks’ upcoming strategy launches are paused for now. “Future strategy launches are delayed for a few days until we feel the contracts are secure,” the team said. “The 5 planned launches will resume afterwards.”
What happened to SquiggleStrategy
TokenWorks first flagged the problem on Sept. 28, 2025, saying it was “actively investigating an exploit on the SquiggleStrategy contract.” At that point it said no other strategy was affected.
The attacker took Chromie Squiggles from the strategy and put cheaper NFTs from the same Art Blocks contract in their place: Genesis by DCA and Construction Token by Jeff Davis. The swap worked because Squiggles live on one contract alongside other Art Blocks projects.
Community member Punks Fanatics commented: “I think the issue is solely with Squiggles, due to the Art Block contract. This happened before on OS.”
The wider bug
Digging into the Squiggle exploit, the team found that the other strategies had the same weakness. It described “a complex way of swapping out an NFT owned by the protocol with a different one on the same contract.”
In most collections, trading one floor NFT for another seems to do no damage. The trouble shows up in the protocol’s records. “So if Bored Ape #2516 was listed at 15e and swapped with Bored Ape #2517 (#2516 is no longer held in the protocol and #2517 is in the protocol), the ape the protocol holds is not listed for sale essentially “bricking” it,” TokenWorks explained.
According to the team, nobody had used the bug outside SquiggleStrategy, and an attacker wouldn’t profit from it. TokenWorks said it moved anyway to prevent a possible denial-of-service attack while the strategies are still young.
A “call option” on bricked NFTs
The swap can also run the other way, TokenWorks said. A user can return the exploited NFT to the protocol, which puts it back up for sale at the intended price, and withdraw one of the “bricked” NFTs.
“This means at any point in the future, the exploited NFT can be sold by the protocol as intended for the listing price,” the team said. “This essentially creates a sort of “call option” on the NFT.”
Should floor prices climb past a listing price, the team said, a rational trader would return the exploited NFT, buy it from the protocol and pocket the gap between that price and the current floor. Doing so would free up the ETH and get the buy-and-burn running again.
The team pointed to one drawback. “The only downside we could find from this is if someone finds their “Forever NFT” and wants to hold on this specific token, the ETH will remain in there until then and may never unlock,” it said.
TokenWorks plans to “eventually build a frontend” so holders of exploited NFTs can swap them back. The team calls that step exercising the call.
SquiggleStrategy becomes “Day One AB”
In SquiggleStrategy’s case, the team said the mechanic results in “all 11,012 NFTs on that contract essentially being treated equally.” The product now goes by the name “Day One AB” strategy.
TokenWorks offered two reasons it likes the change. The first is history: Squiggles by Snowfro, Genesis by DCA and Construction Token by Jeff Davis all launched on Art Blocks’ first day, and plenty of collectors already treat them as a set.
The second is edition size. There are 512 Genesis editions and 500 Construction Tokens, compared with 10,000 Squiggles. TokenWorks said the two smaller collections “are only ~30% off the value of an individual Squiggle.”
Funds and tokens
The ERC20 tokens are fine, TokenWorks said, and fees will continue to pool toward floor NFT purchases. ETH tied up in the affected NFTs is safe, though buy-and-burns may take longer to return it to the LP. The team said the strategy tokens “do NOT need to be redeployed.”
Background
NFTStrategy went live on Sept. 20, 2025. With it, TokenWorks brought the PunkStrategy ($PNKSTR) model to Bored Ape Yacht Club, Pudgy Penguins, Moonbirds, Meebits and CryptoDickbutts.
PunkStrategy takes a 10% swap fee to fill an ETH treasury. That treasury buys the cheapest available CryptoPunk, which is relisted at 1.2 times what it cost, and sale proceeds go toward buying and burning $PNKSTR.
TokenWorks then announced it would roll out one new strategy per day for a week. Chromie Squiggles, CrypToadz, Goblintown, Checks, Max Pain by XCopy, Good Vibes Club and Milady were on the list.
The team ended its post on this note: “Thank you all for the support, and every bump in the road makes us stronger.”