Reveal Top 3 Critical Bugs Found in ThunderNFT Invite Program

ThunderNFT ran an Immunefi IOP from August 12 to September 2, 2024 on Fuel L2. Twelve researchers submitted 41 valid reports, earning $65,000 USDC. Critical flaws included NFT theft via update_order exploit (#34980, Solosync6) and maker losses from hardcoded execution_result.amount=1 in ERC1155 trades (#34534, NinetyNineCrits). Medium severity bug (#34714, zeroK) blocked sell-order NFT owners from accepting bids. All issues fixed.