Art NFT Security and Best Practices Flashcards

An NFT's metadata links to an image stored on a private, company-owned server using a standard HTTPS URL. What is the primary security and longevity risk associated with this storage method?

Answer: The hosting company could alter the image or cease operations, leaving the NFT pointing to a dead or incorrect link.

Storing NFT media on a centralized server creates a single point of failure. If the company hosting the server shuts down, fails to pay its hosting bill, or maliciously decides to change the file, the NFT's visual representation can be lost or altered forever. This undermines the permanence aspect of the NFT. Decentralized solutions like IPFS or Arweave are used to mitigate this risk.

For long-term, high-value storage of NFTs, which type of wallet provides the highest level of security against online threats like malware and phishing attacks?

Answer: A hardware wallet

Hardware wallets, also known as cold wallets, store private keys offline in a secure, isolated hardware device. This makes them immune to online attacks that might compromise a computer or phone, such as malware or remote hacking. Transactions must be physically confirmed on the device itself, providing a crucial layer of security.

A collector receives a direct message on social media with a link to a "surprise mint" for a popular project. The website looks identical to the official one, but the URL is slightly different. The site prompts the user to connect their wallet and approve a transaction to claim the NFT. This scenario is a classic example of what type of attack?

Answer: A phishing attack

This scenario describes a classic phishing attack. Scammers create a replica of a legitimate website with a similar URL to deceive users. They then trick the user into connecting their wallet and signing a malicious transaction that, instead of minting an item, often grants the attacker permission to drain assets from the user's wallet.

Which of the following is a critical best practice to protect against "rug pull" scams when considering minting from a new, unverified NFT project?

Answer: Checking for a verified smart contract on a block explorer and looking for suspicious code or a lack of transparency.

A rug pull involves developers abandoning a project after collecting funds. A crucial due diligence step is to check the project's smart contract on a block explorer (like Etherscan). Verifying the contract, examining the code for malicious functions (e.g., ones that allow the owner to drain funds), and assessing the team's transparency are key indicators of legitimacy. Social media followers can be easily faked, and gas fees or the wallet used have no bearing on the project's trustworthiness.

When interacting with a new decentralized application, your wallet prompts you to approve a transaction but displays the data as a long, unreadable string of hexadecimal characters. Authorizing this transaction without being able to verify its contents is known as what?

Answer: Blind signing

Blind signing occurs when a user approves a transaction without fully understanding what they're agreeing to because the wallet cannot display the details in a human-readable format. You are trusting the dApp's interface completely. Malicious dApps exploit this to trick users into signing harmful transactions, such as those that drain assets from their wallet.

A user interacts with a malicious NFT marketplace that tricks them into signing a 'SetApprovalForAll' transaction. What is the primary and most immediate danger of this specific action?

Answer: It grants the marketplace permission to transfer ALL NFTs from that specific collection out of the user's wallet at any time.

The 'SetApprovalForAll' function is a standard feature in ERC-721 and ERC-1155 contracts. Legitimate marketplaces use it to gain permission to transfer an NFT on the user's behalf when it's sold. However, malicious sites trick users into approving this for a scammer's address, which gives that address permission to take any and all NFTs from that collection out of the user's wallet without further approval.