On June 26, 2022, XCarnival NFT lending protocol was exploited via a vulnerability in collateral tracking where the orderID remained open after withdrawal. The attacker generated multiple contract addresses, used the same BAYC NFT as collateral, and repeated the deposit-borrow-withdraw cycle to obtain an infinite number of loans, siphoning 3,087 ETH (~$3.8M).

The NFT liquidity solver XCarnival was attacked, the hacker made a profit of 3,087 ETH (about 3.8 million US dollars), and the hacker has returned 1,467 ETH after the negotiation. The core of this vulnerability is that when borrowing, there is no judgment on whether the NFT in the order has been withdrawn.