🔥 Off-chain accounting breaks everything again

⚫️ Yesterday was not exactly a great evening for Telegram Gifts collectors. A technical vulnerability was found on MRKT, a popular marketplace, allowing users to effectively inflate their balances: sending offers without funds being deducted, canceling them while receiving extra funds, or withdrawing the same GRAM multiple times.

⚫️ The whole issue came down to off-chain accounting: the marketplace handled balances, offers, and trades internally, but at some point that logic broke. The exact damage is hard to estimate right now, but according to the community, users managed to withdraw at least 14 Plush Pepes, 59 Durov’s Caps, several dozen other expensive gifts, and tens of thousands of GRAM through the bug.

⚫️ In this situation, we cannot help but point out one thing: none of this would have been possible if gift trading were settled on-chain. On-chain, you simply cannot buy the same gift dozens of times without paying for it or withdraw the same GRAM over and over again.

⚫️ Telegram Gifts could have become an easy entry point into crypto: a user receives or buys a gift in Telegram, sees a secondary market around it, opens a marketplace, sees prices in GRAM, and takes their first step toward crypto. But every time an off-chain layer breaks, the backlash does not just hit a specific service — it hurts the reputation of the entire TON ecosystem.

⚫️ So the only advice we can give here is this: convert your gifts into NFTs and trade them on Fragment or other TON marketplaces where transactions are settled on-chain. Especially since many of them do not charge seller fees.

@thedailyton