NFT Smart Contract Security 2

Question 1

In an ERC-721 contract, which function should use _safeMint instead of _mint when the recipient may be a contract?

Accepted Answer

When the recipient must be verified to accept ERC-721 tokens via onERC721Received

Answer

When minting to an externally owned account only

Answer

When gas costs must be minimized at all costs

Answer

When the token ID is randomly generated

Question 2

What is a reentrancy attack in the context of an NFT marketplace contract?

Accepted Answer

An attacker repeatedly calls back into the contract before state updates complete, draining funds

Answer

An attacker submits the same transaction twice in one block

Answer

An attacker overflows a uint256 counter

Answer

An attacker mints two tokens with the same ID

Question 3

Which pattern best prevents reentrancy in a withdraw function?

Accepted Answer

Checks-Effects-Interactions: update state before making external calls

Answer

Interactions-Effects-Checks order

Answer

Calling external contracts first to validate

Answer

Using tx.origin for authentication

Question 4

Why is using tx.origin for authorization in an NFT contract dangerous?

Accepted Answer

A malicious intermediary contract can trick the user into authorizing actions via phishing

Answer

It costs more gas than msg.sender

Answer

It cannot be read inside modifiers

Answer

It returns a random address each call

Question 5

What does the OpenZeppelin ReentrancyGuard's nonReentrant modifier do?

Accepted Answer

Sets a lock flag preventing the function from being called again until it completes

Answer

Caps the number of NFTs minted per block

Answer

Validates ERC-165 interface support

Answer

Encrypts the function's storage variables

Question 6

An NFT minting function uses block.timestamp for randomness in trait assignment. Why is this insecure?

Accepted Answer

Miners/validators can influence block.timestamp to manipulate outcomes

Answer

block.timestamp is always zero on mainnet

Answer

It causes an integer underflow

Answer

It is not accessible from within functions

Question 7

What is the risk of leaving an NFT contract's mint function without access control?

Accepted Answer

Anyone can mint unlimited tokens, destroying scarcity and value

Answer

The contract cannot be deployed

Answer

Gas fees become unpredictable

Answer

The metadata URI gets corrupted