Exclusive: Yuga Labs’ 0xQuit Reveals New “CryptoPunks 721” Wrapper

Today, Dec. 20, Yuga Labs has revealed its new wrapper for CryptoPunks, allowing the groundbreaking early NFTs—which were created in 2017, before the widely-used ERC-721 standard launched in January 2018—to be traded as smoothly and seamlessly as more recently-created NFTs can be.

A wrapped CryptoPunk gains all the advantages of an ERC-721, which means that holders can perform useful actions that are commonplace today—like borrowing money against a Punk—that are not possible with an unwrapped Punk.

We spoke to Yuga’s own smart contracts expert and security wizard extraordinaire, an anonymous developer known as 0xQuit. He’s been spearheading the effort to launch the new wrapper—which Yuga is calling “CryptoPunks 721.”

“I’m sure everyone reading this is probably familiar with CryptoPunks already. They’re a bit of a unique project because they were released before the ERC-721 standard was released, so they don’t have a lot of the same capabilities that NFTs today do, right? Meaning, you can’t set approvals, which means you can’t trade them on OpenSea, you can’t trade them on Blur, you can’t really do a lot of the composable things that other entities can do. And obviously, we don’t want to destroy the provenance of Punks by migrating the contract, so the solution is to wrap them,” he told nft now.

Wrapper contracts have existed for a long time, including for Punks, but while they’ve been revolutionary, opening up the full power of ERC-721 to the Punk ecosystem, Yuga saw an opportunity to create a new wrapper that is safe and easy to use, 0xQuit told us. “One person has [accidentally] burned their Punk, one person has set their Punk to what they thought was the correct address, but it turned out not to be right. So, we are releasing our own full solution. That involves a new wrapper [contract] and an interface for the wrapper, so everything should be really safe and straightforward,” he said.

“We are releasing our own full solution. That involves a new wrapper and an interface for the wrapper, so everything should be really safe and straightforward.”

0XQUIT

Created by Matt Hall and John Watkinson, the creative technologists known as Larva Labs, the 10,000 CryptoPunks were free to claim for anyone with an Ethereum address. They came with their own built-in marketplace which is still in use daily (and is not going away), but has its own pitfalls, like front-running—the risk that when you want to sell your Punk to a specific individual, someone else will step in with a slightly higher bid, and snipe the Punk away from its intended buyer.

Wrapping your Punk solves this—a CryptoPunks 721-wrapped Punk can be listed on a standard NFT marketplace, where you can take advantage of all of that marketplace’s features. Furthermore, CryptoPunks 721 are accessible to folks who might be new to crypto, according to 0xQuit.

“If you’re not too familiar with crypto in general at the moment, Punks are probably outside of your expertise—if you wanted to buy a Punk,  you maybe couldn’t figure out how to do it. The common websites don’t support them, you have to go to this old legacy marketplace. It’s just a little bit more involved, right? So these wrapped Punks give people an easy way to go to Blur and OpenSea and x2y2, and all of these exchanges, and just purchase a Punk if they want one,” he said.

The new contract from Yuga, along with its crystal-clear interface, makes wrapping—and unwrapping—your Punks a seamless and straightforward process. There’s one important caveat, particularly in the light of the spate of security issues the space has recently weathered: as pre-ERC-721 tokens, Punks have largely been safe from the risk of theft that nearly every other NFT in the space faces. Wrapping your Punk, whether it’s with this new wrapper or previously-built ones, exposes it to the risks that everything from Squiggles to Bored Apes face on a daily basis. So, if you’re not actively using the extra features like marketplace listing, lending or borrowing that a 721 Punk provides, it’s best to unwrap, according to 0xQuit.

As the veil lifts on CryptoPunks 721 today, it reveals a series of contracts: Yuga’s brand-new wrapper, as well as a tool called “Punk Stashes.” To explain, 0xQuit needed to get a little bit technical. “With the old wrapper, [when you wanted to wrap your Punk] you would deploy a proxy contract, transfer your Punk to that proxy contract, and then wrap it from there. [With CryptoPunks 721,] your stash serves as that proxy—but comes with a bunch of other fun toys as well,” he said.

These yet-to-be-revealed fun toys will include the ability for Yuga to upgrade the wrapper, adding new features like auction mechanics. The Stash contracts will also play a role in Yuga’s soon-to-be-revealed solution for frontrunning—a solution that will be available even for people who are trading on Matt and John’s original built-in CryptoPunks marketplace.

Safety features are built-in, too. “[Our new contract] is deployed at an address with 14 leading zeros, which is a very rare address. Obviously it looks pretty, makes [the correct address] easy to identify, and it actually makes it cheaper to transact with these entities by a very small amount,” 0xQuit said.

The smart contract developer known as emo_eth, who co-authored OpenSea’s Seaport contract, developed a solution that allows Larva Labs’ original data contract for CryptoPunks to be read by today’s marketplaces, says 0xQuit. Yuga’s CryptoPunks 721 makes great use of this innovation. “We have no external dependencies at all for our metadata. It’s fully on chain. I think that’s pretty cool,” 0xQuit told us.

Yuga’s Stash Engine—the upgradable contract that powers CryptoPunks 721—keeps track of all 10,000 CryptoPunks, and knows which address each Punk’s Stash would be located at, if it were to be wrapped. This saves a step for first-time wrappers, who won’t have to deploy a Stash before they wrap their Punk.

The new tool also means that Punks can be wrapped and unwrapped in a batch, saving time—and a bit of gas, which is important when gas prices are quite high as liquidity returns to the NFT market.

The tension between security and ease of use in web3 has been at the forefront of 0xQuit’s mind—particularly as a devastating series of attacks over Dec. 16-17 led to many holders of valuable NFTs losing their assets. As a leader in BoringSecDAO, the ApeCoin funded project to educate holders about good security practices, 0xQuit helped to negotiate the return of the stolen Bored Apes. We asked him what the solution is, long-term.

“Every single approval you set is really giving something permission to move your asset at will. While some things may seem safe, there are bugs that exist in code. Some things can be maliciously upgraded or changed.”

0xQUIT

“If you approve nothing, your assets are safe, as long as your private key is not compromised, as long as you don’t sign a transfer. So then you’re not vulnerable to this kind of stuff—but obviously, if you’ve approved nothing, then you can’t do a lot of the cool things that we’ve built in crypto. You can’t buy and sell on OpenSea, and you can’t deposit to BendDao and lend out stuff, or borrow against your assets—or take advantage of all of these things that the composability of ERC-721 tokens were built for. I think what people really need to focus on is that every single approval you set is really giving something permission to move your asset at will. While some things may seem safe, there are bugs that exist in code. Some things can be maliciously upgraded or changed. So whenever you set an approval, if you don’t intend on using that approval every day, you should just revoke it once you’re done. Otherwise, you’re in the situation where you have trust in 20, 30, 40 parties—because you have all these open approvals, and any one of them could end up being an attack vector,” he said.

As a seasoned security expert, 0xQuit suggests a simple solution—keeping multiple wallets, each with a different layer of security. “So personally, I have a vault address that does not have open approvals for anything, and that’s where I keep the things that I care about the most. And then obviously you do want a degen wallet, for when you want to do like the hyped mints, and trades and things like that. You can do that from another wallet. I think as long as you adhere to that, you should be fine,” he said.