Summary
Gondi V3 is a decentralized, non-custodial NFT lending and borrowing protocol on Ethereum developed by Florida Street, which launched in July 2023 and raised a $5.35 million seed round from Hack.vc, Dragonfly Capital, and Pantera Capital. On March 9, 2026, the protocol suffered a smart contract exploit in its newly deployed Purchase Bundler component, resulting in the theft of approximately 78 NFTs valued at roughly $230,000 from users who had granted approvals to the vulnerable contract. The team disabled the affected feature, pledged full restitution using protocol fees, and engaged security firm Blockaid for a post-incident review; platform operations for other functions resumed the following day.
Connected Entities
1 entitiesTimeline(8 events)
2023-07-11
Gondi NFT lending protocol launches publicly on Ethereum; Florida Street announces $5.35 million seed round co-led by Hack.vc and Foundation Capital with participation from Dragonfly Capital and Pantera Capital.
2024-04-08
Code4rena (Zenith) conducts a Gondi Invitational audit with $74,600 USDC in prizes, reviewing V3 smart contracts.
2024-05-14
Code4rena conducts a Gondi Mitigation Review audit, identifying issues including tranche accounting errors, division ordering bugs, and access control gaps; mitigation review period runs through May 24, 2024.
2026-02-20
Gondi deploys an updated version of the Sell & Repay contract containing the Purchase Bundler component with a missing caller-verification check in the buy function.
2026-03-09
At approximately 8:12 AM UTC, an attacker executes approximately 40 transactions exploiting the Purchase Bundler's missing msg.sender check, draining 78 NFTs worth approximately $230,000 from users with active approvals but no outstanding loans. Blockaid detects and publicly discloses the attack. Stolen collections include Art Blocks, Doodles, SuperRare, and Beeple works.
2026-03-09
Gondi disables the Sell & Repay functionality and advises all users to revoke approvals for affected contracts via Revoke.cash. The team confirms active loan collateral was not affected.
2026-03-10
Gondi platform resumes operations for buying, selling, trading, and lending functions with the compromised contract excluded. Blockaid and an independent auditor review remaining contracts and clear them as safe. Gondi pledges restitution via protocol fee-funded comparable NFT purchases.
2026-03-10
Community members return several NFTs voluntarily, including Doodle, Aluminum Gazer, Lil Pudgy, and Servant of the Muse tokens. The largest single victim's loss is identified as approximately $108,000.
Decision Log
- hash: GZnDe2ixH54D11fd3EM42EkY3BUXStPNJJBKYbw96Y9w
- hash: 5PKpJ1SFsSf1KJtN2KwbuftpuzasNCi541tD3583rqS9
- hash: 9DKwA5bjzq2JtkysuVcT16PDoFeCwPWdN1YEHxxmQ7Mk
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:18 AM
last updated: 6/10/2026, 2:19:19 PM
avoid.net — verified advice for a post-truth world