{"investigation":{"slug":"doingud-nft-diamond-bidding-contract-exploit","entity_name":"DoinGud NFT Diamond Bidding Contract Exploit","trust_score":42,"severity_base":null,"score_modifier":0,"confidence":0.3,"status":"draft","content_type":"investigation","summary":"DoinGud was a Polygon-based, socially-conscious NFT marketplace and creator platform launched in 2021 and backed by venture investors including Alameda Ventures and CSP DAO. The project appears to have gone dormant and was reportedly acquired by a company called Cleo around January 2024, after which it stopped operating as an independent platform. A report circulating in security-monitoring circles alleges that on or around September 21, 2026, an attacker exploited a flaw in DoinGud's EIP-2535 'Diamond' bidding smart contract on Polygon — where the acceptBid function allegedly paid out a bid without marking it as consumed, letting the same bid be accepted twice — to drain roughly $35,486 in USDC.e. Despite extensive searching of security-incident trackers, hack databases, and news outlets, this investigation could not locate an independent, verifiable primary source (block-explorer transaction, security-firm postmortem, or mainstream news report) corroborating the exploit; it is treated here as an unverified, low-confidence allegation, while the platform's underlying dormancy and change of ownership are independently documented and support the broader concern about abandoned contracts holding live funds.","sections":[{"content":"DoinGud was announced in a press release on May 19, 2021 as a 'creator-first' NFT platform built on Polygon (then still commonly referred to as Matic), positioned as a socially-conscious marketplace that would allocate a minimum of 5% of each sale to a social-impact organization chosen by the creator. The project raised approximately $5 million from investors including Alameda Ventures, CSP DAO, CitizenX, Criterion VC, and DAOSquare, and was headquartered in Zug, Switzerland. Coverage at launch described a marketplace with credit-card and crypto payment options, automated royalty/collaboration splitting, and an associated DAO membership structure ('Gud Souls'). None of the launch-era coverage located in this investigation described any fraud, exit scam, or securities issue associated with the founding team.","heading":"Background: What DoinGud Was","sources":[{"url":"https://www.prnewswire.com/news-releases/doingud-a-new-nft-platform-where-every-transaction-does-good-301295276.html","name":"DoinGud: A New NFT Platform Where Every Transaction Does Good (PR Newswire)","type":"official","credibility":2},{"url":"https://coinjournal.net/news/doingud-nft-platform-to-share-profits-with-social-causes/","name":"NFT platform shares profit with social causes","type":"news_article","credibility":2},{"url":"https://crypto-economy.com/a-new-community-driven-nft-platform-doingud-is-launching-this-summer/","name":"A New Community-Driven NFT Platform DoinGud is Launching this Summer","type":"news_article","credibility":2}],"severity":"low"},{"content":"Company-profile aggregators (PitchBook, Tracxn) indicate that DoinGud is no longer active as an independent company and was acquired by a company identified as Cleo (United States) around January 2024. This investigation could not directly access the full underlying PitchBook/Tracxn profile pages (both returned paywall/authentication errors on direct fetch), so the acquisition detail rests on aggregator search-result summaries rather than a directly quoted primary filing, and should be treated as moderately, not fully, confirmed. Independently, DoinGud's public-facing activity (social media, blog) appears to have gone quiet well before September 2026, consistent with the scout report's characterization of the platform as 'dormant.' A dormant project with smart contracts that still hold or can still receive funds is a recognized category of risk in DeFi/NFT infrastructure: nobody is actively monitoring, patching, or responding to incidents.","heading":"Platform Dormancy and Reported Acquisition by Cleo","sources":[{"url":"https://pitchbook.com/profiles/company/466201-00","name":"DoinGud 2026 Company Profile: Valuation, Investors, Acquisition (PitchBook)","type":"research","credibility":3},{"url":"https://tracxn.com/d/companies/doingud/__QjMCflTyekG5ww-SHvI082cy7Xs4wqGN2K6lZ5EsG2A","name":"DoinGud - 2026 Company Profile, Team, Funding & Competitors (Tracxn)","type":"research","credibility":3}],"severity":"medium"},{"content":"A report supplied to this investigation states that on September 21, 2026, DoinGud's 'Diamond' (EIP-2535 multi-facet proxy) bidding contract on Polygon was exploited through a bid-record-clearing flaw: the contract's acceptBid function allegedly paid out the bid amount without marking the bid as consumed, so the same bid record could be accepted more than once. The report alleges an attacker flash-loaned an amount of USDC equal to the contract's balance, placed a bid on themselves, called acceptBid twice against that single bid, and extracted approximately $35,486 in USDC.e. This investigation searched security-incident aggregators and hack trackers (SlowMist's hacked-event database, PeckShield/PeckShieldAlert, CertiK, DeFiLlama's hacks list, rekt.news, and Web3 Is Going Just Great), mainstream and crypto-native news outlets, GitHub advisories, and Immunefi's bug-bounty listings, and found no independent report, postmortem, or on-chain-explorer confirmation of this incident. The only citation available for the claim is a single social-media (X/Twitter) post; its content could not be independently verified because the platform returned an access error (HTTP 402) when this investigation attempted to retrieve it directly. Given the EIP-2535 Diamond pattern is a real, widely used upgradeable-proxy standard and DoinGud is independently confirmed to have used Polygon infrastructure, the described attack mechanism (bid-replay via a missing 'consumed' flag, financed via flash loan) is technically plausible for an abandoned marketplace contract — but plausibility is not confirmation. This section, and the associated timeline entry, should be treated as an unverified allegation pending a primary source (a Polygon transaction hash, a security firm's writeup, or an official DoinGud/Cleo statement).","heading":"Alleged September 2026 Diamond Bidding Contract Exploit (Unverified)","sources":[{"url":"https://x.com/teddyctf/status/2102235278970933264","name":"Unverified social media post alleging the DoinGud exploit","type":"social_media","credibility":3}],"severity":"medium"},{"content":"Independent of whether the specific September 2026 incident is confirmed, DoinGud illustrates a general and well-documented category of risk in the NFT/DeFi space: upgradeable, modular contracts (such as those built on the EIP-2535 'Diamond' multi-facet proxy standard) that continue to hold or route funds after the team behind them has gone quiet, been acquired, or stopped active development. EIP-2535 was designed to let large contract systems be split into upgradeable 'facets' sharing a common proxy, which is powerful for active development but means an abandoned deployment can retain complex, unaudited-in-practice logic (like bid/escrow accounting) that nobody is monitoring for edge cases. Users and integrators are generally advised to check whether a project's contracts are still actively maintained, audited, and monitored before interacting with legacy marketplace or bidding functionality on platforms that have otherwise gone dark.","heading":"Broader Risk Pattern: Abandoned Contracts with Live Funds","sources":[{"url":"https://eips.ethereum.org/EIPS/eip-2535","name":"ERC-2535: Diamonds, Multi-Facet Proxy","type":"official","credibility":2}],"severity":"medium"}],"timeline":[{"date":"2021-05-19","event":"DoinGud publicly announced as a new Polygon-based, socially-conscious NFT platform, with a summer 2021 launch targeted.","source":"PR Newswire","source_url":"https://www.prnewswire.com/news-releases/doingud-a-new-nft-platform-where-every-transaction-does-good-301295276.html","date_evidence":"Publication dateline on the press release: \"May 19, 2021, 14:04 ET\""},{"date":"2024-01","event":"DoinGud reportedly acquired by a company identified as Cleo (United States), after which it ceased operating as an independent platform.","source":"PitchBook / Tracxn company profiles (aggregator data, not directly verified from a primary filing)","source_url":"https://pitchbook.com/profiles/company/466201-00"},{"date":"2026-09","event":"Alleged exploit of DoinGud's Diamond bidding contract on Polygon via a bid-replay flaw in acceptBid, reportedly draining approximately $35,486 in USDC.e via a flash-loan-funded, self-bid, double-accept sequence. This event is unverified by this investigation; no independent security-firm or news corroboration was found.","source":"Single unverified social media post","source_url":"https://x.com/teddyctf/status/2102235278970933264"}],"sources_used":[{"url":"https://www.prnewswire.com/news-releases/doingud-a-new-nft-platform-where-every-transaction-does-good-301295276.html","name":"DoinGud: A New NFT Platform Where Every Transaction Does Good (PR Newswire)","type":"official","archive_url":"https://web.archive.org/web/20260922204023/https://www.prnewswire.com/news-releases/doingud-a-new-nft-platform-where-every-transaction-does-good-301295276.html","credibility":2,"archive_timestamp":"2026-09-22T20:40:23+00:00"},{"url":"https://coinjournal.net/news/doingud-nft-platform-to-share-profits-with-social-causes/","name":"NFT platform shares profit with social causes","type":"news_article","archive_url":"https://web.archive.org/web/20260922203544/https://coinjournal.net/news/bitcoin-losses-hit-38-5k-heres-how-to-short-bitcoin-for-profit/?dynamic","credibility":2,"archive_timestamp":"2026-09-22T20:35:44+00:00"},{"url":"https://crypto-economy.com/a-new-community-driven-nft-platform-doingud-is-launching-this-summer/","name":"A New Community-Driven NFT Platform DoinGud is Launching this Summer","type":"news_article","archive_url":"https://web.archive.org/web/20260922171704/https://crypto-economy.com/a-new-community-driven-nft-platform-doingud-is-launching-this-summer/","credibility":2,"archive_timestamp":"2026-09-22T17:17:04+00:00"},{"url":"https://pitchbook.com/profiles/company/466201-00","name":"DoinGud 2026 Company Profile: Valuation, Investors, Acquisition (PitchBook)","type":"research","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://tracxn.com/d/companies/doingud/__QjMCflTyekG5ww-SHvI082cy7Xs4wqGN2K6lZ5EsG2A","name":"DoinGud - 2026 Company Profile, Team, Funding & Competitors (Tracxn)","type":"research","archive_url":"https://web.archive.org/web/20260922210931/https://tracxn.com/d/companies/doingud/__QjMCflTyekG5ww-SHvI082cy7Xs4wqGN2K6lZ5EsG2A#news","credibility":3,"archive_timestamp":"2026-09-22T21:09:31+00:00"},{"url":"https://x.com/teddyctf/status/2102235278970933264","name":"Unverified social media post alleging the DoinGud exploit","type":"social_media","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://eips.ethereum.org/EIPS/eip-2535","name":"ERC-2535: Diamonds, Multi-Facet Proxy","type":"official","archive_url":"http://web.archive.org/web/20260909223033/https://eips.ethereum.org/EIPS/eip-2535","credibility":2,"archive_timestamp":"2026-09-09T22:30:33+00:00"}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-09-22T17:16:40.050948+00:00","updated_at":"2026-09-22T21:21:17.087765+00:00"}}