At 9AM EST today somebody abused a bug in Payment Processor V2 to steal 10 Meebits, 50 Otherdeeds, 10 WoW, and 235 Desperate Apewives. It wasn't until over 12 hours later that somebody reported it to me, and upon digging in I realized that a great many NFTs were subject to the same exploit. I got in touch with the team over at LimitBreak and they quickly paused Payment Processor V3, which was subject to the same exploit. Unfortunately, V2 was not pausable, so the only path towards protecting affected assets was to run a whitehat operation. Similarly, V3 on ApeChain is temporarily in a state where it cannot be paused, so ApeChain assets approved to V3 needed to be saved as well. All in all, we rescued 23,155 NFTs worth north of $5.7M USD. We later discovered that a similar exploit could be used in reverse to steal WETH. 660 WETH was at risk, which we unfortunately were not fast enough to recover. Apologies to those affected. Shout out to @Boomskite for flagging the initial exploit tx to me, and @coffeedev @0xjustadev and @whiteoakkong for acting quickly and assisting with the recovery. All NFTs are safely relocated. Soon, owners will be able claim them back after revoking the exploitable approvals. Addresses to revoke below.

REVOKE APPROVALS TO THESE ASAP: Payment Processor V2 on Ethereum: 0x9A1D00bEd7CD04BCDA516d721A596eb22Aac6834 Payment Processor V3 on ApeChain: 0x9a1D00000000fC540e2000560054812452eB5366 use revoke.cash or similar.

FWAP now supports FWA V2. Instead of a flat 0.06 ETH backing, any FWA eligible asset can be deposited to FWAP using FWA's oracle defined backing price. Assets with higher projected APY will be backed before lower ones (~0.06 ETH is still the optimal backing).

A migration page is available for anybody who has assets deposited in older FWAP contracts. Seamlessly batch migrate or batch withdraw your assets. If you have assets that are not compatible with FWA V2 (TTTs, Friendship Bracelets), withdrawal will be the only presented option.