Gondi V3
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·2DuX9v…B6fvSummary
Gondi V3 is a decentralized, non-custodial NFT lending and borrowing protocol on Ethereum developed by Florida Street, which launched in July 2023 and raised a $5.35 million seed round from Hack.vc, Dragonfly Capital, and Pantera Capital. On March 9, 2026, the protocol suffered a smart contract exploit in its newly deployed Purchase Bundler component, resulting in the theft of approximately 78 NFTs valued at roughly $230,000 from users who had granted approvals to the vulnerable contract. The team disabled the affected feature, pledged full restitution using protocol fees, and engaged security firm Blockaid for a post-incident review; platform operations for other functions resumed the following day.
Connected Entities
4 entities · 60 linked investigations- Gondi V3→mentioned with→Ethereum(80%)
- Gondi V3→mentioned with→ZachXBT(60%)
- Gondi V3→mentioned with→SuperRare(65%)
- ZachXBT→mentioned with→Ethereum(70%)
- SuperRare→mentioned with→Ethereum(70%)
Timeline(8 events)
11 July 2023
Gondi NFT lending protocol launches publicly on Ethereum; Florida Street announces $5.35 million seed round co-led by Hack.vc and Foundation Capital with participation from Dragonfly Capital and Pantera Capital.
8 April 2024
Code4rena (Zenith) conducts a Gondi Invitational audit with $74,600 USDC in prizes, reviewing V3 smart contracts.
14 May 2024
Code4rena conducts a Gondi Mitigation Review audit, identifying issues including tranche accounting errors, division ordering bugs, and access control gaps; mitigation review period runs through May 24, 2024.
20 February 2026
Gondi deploys an updated version of the Sell & Repay contract containing the Purchase Bundler component with a missing caller-verification check in the buy function.
9 March 2026
At approximately 8:12 AM UTC, an attacker executes approximately 40 transactions exploiting the Purchase Bundler's missing msg.sender check, draining 78 NFTs worth approximately $230,000 from users with active approvals but no outstanding loans. Blockaid detects and publicly discloses the attack. Stolen collections include Art Blocks, Doodles, SuperRare, and Beeple works.
9 March 2026
Gondi disables the Sell & Repay functionality and advises all users to revoke approvals for affected contracts via Revoke.cash. The team confirms active loan collateral was not affected.
10 March 2026
Gondi platform resumes operations for buying, selling, trading, and lending functions with the compromised contract excluded. Blockaid and an independent auditor review remaining contracts and clear them as safe. Gondi pledges restitution via protocol fee-funded comparable NFT purchases.
10 March 2026
Community members return several NFTs voluntarily, including Doodle, Aluminum Gazer, Lil Pudgy, and Servant of the Muse tokens. The largest single victim's loss is identified as approximately $108,000.
Decision Log
- slot 445504968 · hash BFmWXZAQ4wSnzco3E9PBumyvo7ANfAZVGZYXCAxbRVXo
- slot 425562428 · hash GZnDe2ixH54D11fd3EM42EkY3BUXStPNJJBKYbw96Y9w
- slot 425562420 · hash 5PKpJ1SFsSf1KJtN2KwbuftpuzasNCi541tD3583rqS9
- slot 422849408 · hash 9DKwA5bjzq2JtkysuVcT16PDoFeCwPWdN1YEHxxmQ7Mk
This investigation is cryptographically anchored to the Solana blockchain (4 decisions). 15 of 15 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:18 AM
last updated: 8/29/2026, 1:32:52 AM
15 viewsavoid.net — verified advice for a post-truth world