Attacker Hijacks Delegate Rights on The Sandbox's Cross-Chain Token and Mints Unbacked SAND

The Sandbox, the blockchain gaming network behind the SAND token, stopped bridging on Base and BNB Smart Chain after an attacker minted SAND on those networks with nothing locked behind it. The company warned users not to trade SAND on the affected chains and put the direct impact at less than 0.01% of the token's 3 billion supply, a figure crypto.news also reported.

The mechanism was not a broken mathematical assumption. It was privileged configuration. The token uses the omnichain fungible token standard from LayerZero, a cross-chain messaging protocol, in which a designated delegate account can set the contract's messaging configuration. According to the proof-of-concept published by DeFiHackLabs and a parallel reconstruction of the same path, the attacker reached that delegate role through the token's approveAndCall function, then used the resulting control to have destination-chain contracts credit tokens that no source-chain deposit backed.

The headline numbers and the real numbers diverge sharply. Security researchers cited by The Cryptonomist and other outlets counted hundreds of mint transactions creating tens of billions of dollars of face-value SAND. Tokens created without backing cannot be sold for anything close to their nominal value, because the order books on Base and BNB Smart Chain are thin. The extraction that mattered ran through the Ethereum-side adapter, roughly 14.75 million SAND, about $675,000, part of which was converted into ether. The Sandbox says it is preparing compensation for affected liquidity providers.

The pattern is familiar and getting expensive. Cross-chain token standards concentrate authority in a small set of administrative roles, and those roles are frequently reachable through a function nobody modelled as an entry point. The contract behaved as written, but the permission model failed to anticipate that a callback function could reach the delegate role.