Flooring Protocol's contract upgrade introduced a vulnerability in its multicall mechanism that lacked proper context isolation. Attackers exploited this to call transferFrom on user NFT approvals without consent, stealing 36 Pudgy Penguins and 14 Bored Apes.

On December 17th, according to SlowMist Cos, Flooring Protocol may have been subjected to a hacker attack, and users are advised to promptly revoke contract authorizations. In a tweet on December 17th, Flooring Protocol announced that "We have determined the cause of exploit to be linked to FP's peripheral/multi-call contract. The team has deployed a fix 2 hours ago, patching the issue. While we continue to investigate and monitor, rest assured that the main contract is safe. Assets in vaults and safeboxes are not affected."