The Sandbox SAND: approveAndCall Flaw Lets Attacker Mint 329T Unbacked Tokens via LayerZero

Root Cause

The Sandbox deployed an OFT (Omnichain Fungible Token) contract for SAND on Base that included an approveAndCall function. This function allowed an external caller to set LayerZero delegate permissions on behalf of the contract. The attacker exploited this to designate themselves as the bridge delegate, granting unauthorized control over cross-chain message verification and token minting.

This was an application-level misconfiguration in The Sandbox's OFT contract; it is not a flaw in the LayerZero protocol itself.

// Simplified vulnerable pattern (illustrative)
function approveAndCall(
    address spender,
    uint256 amount,
    bytes calldata data
) external returns (bool) {
    _approve(msg.sender, spender, amount);
    // VULNERABILITY: no restriction on what 'data' can do
    // Attacker encodes a setDelegate() call to LayerZero endpoint
    ILayerZeroEndpoint(lzEndpoint).setDelegate(attackerAddress);
    return true;
}

Once the attacker held delegate authority over the LayerZero endpoint for the Base SAND OFT, they could forge cross-chain messages and instruct the contract to mint arbitrary amounts of SAND on Base and BNB Smart Chain without any corresponding lock on Ethereum.

Attack Steps

Impact

• Actual loss: ~14.75M SAND ≈ $675K (80 ETH)
• Unbacked supply minted: ~329.24T SAND (nominal ~$49B; not sellable at scale)
• Chains affected: Base (primary exploit), BNB Smart Chain (secondary)
• Unaffected: SAND on Ethereum and Polygon
• Date: 21–22 August 2026
• Containment: The Sandbox disabled bridging within hours; confirmed < 0.01% of SAND supply was redeemable

Lessons for Auditors

1. No privileged calls through approveAndCall: The approveAndCall pattern should never be able to execute calls that modify bridge authority, ownership, or delegate settings. Treat it as equivalent to an arbitrary external call and restrict what the data payload can target.
2. LayerZero delegate separation: OFT contracts that use LayerZero should never allow the delegate address to be set by an unpermissioned external call. The delegate setter should be onlyOwner or onlyMultisig at minimum.
3. Bridge invariant checks: Minting on a destination chain should be provably one-to-one with a lock on the source chain. Consider using a monotonic counter or a merkle proof of source-chain lock.
4. Mint rate-limiting: Large cross-chain mints (e.g., > 1% of circulating supply in a single transaction) should trigger a pause or a multi-sig confirmation requirement.