Practice Test GeeksNFT Development Practice Test
← All NFT Flashcard Decks

Smart Contract Security Audits Flashcards

7 cards from real NFT practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 Smart Contract Security Audits flashcards as text

  1. A signature-based NFT mint allowlist is found to be replayable across chains. Which EIP standard prevents this when implemented correctly?

    Answer: EIP-712 with chainId in the domain separator

    EIP-712 domain separators include chainId, binding signatures to a specific chain and preventing cross-chain replay.

  2. During an audit you notice a withdraw() that sends ETH using transfer(). What is the modern best-practice concern?

    Answer: transfer's 2300 gas stipend can break with future opcode repricing

    The fixed 2300 gas stipend of transfer may fail for contract recipients after gas cost changes, so call with checks is preferred.

  3. An auditor finds that an NFT contract inherits Ownable but never calls renounceOwnership or uses a multisig. What recommendation is most appropriate?

    Answer: Transfer ownership to a timelock or multisig

    Concentrated owner privileges should be mitigated by a multisig or timelock to reduce single-point-of-failure risk.

  4. Which static analysis tool by Trail of Bits is widely used for auditing Solidity contracts?

    Answer: Slither

    Slither is a static analysis framework that detects vulnerabilities and code-quality issues in Solidity.

  5. An ERC-1155 batch transfer fails to validate that the recipient implements onERC1155Received. What risk does this create?

    Answer: Tokens permanently locked in a non-receiver contract

    Without the receiver hook check, tokens sent to incompatible contracts can become irretrievable.

  6. A reviewer identifies that the mint price is read from a public storage variable an owner can change mid-transaction batch. This enables what attack?

    Answer: Front-running / price manipulation

    An owner observing the mempool can change the price before a user's transaction confirms, manipulating what buyers pay.

  7. What does the 'unchecked' block in Solidity 0.8+ do that auditors must scrutinize?

    Answer: Disables overflow/underflow checks for gas savings

    unchecked blocks remove automatic arithmetic safety checks, reintroducing overflow risk if used incorrectly.