Gondi V3 NFT Lending — PurchaseBundler Access Control Flaw

Attacker exploited the PurchaseBundler contract in Gondi V3, an NFT lending protocol. The vulnerable function failed to verify that msg.sender was the legitimate borrower, allowing unauthorized purchases. The attacker stole 78 high-value NFTs including Art Blocks, Doodles, and Beeple pieces worth approximately $230,000. The Gondi team disabled the affected contract following the exploit.