NFT Smart Contract Security 2

Question 1

In an ERC-721 contract, which function should use _safeMint instead of _mint when the recipient may be a contract?

Accepted Answer

When the recipient must be verified to accept ERC-721 tokens via onERC721Received

Answer

_safeMint checks that contract recipients implement onERC721Received, preventing tokens from being locked in incompatible contracts.

Question 2

What is a reentrancy attack in the context of an NFT marketplace contract?

Accepted Answer

An attacker repeatedly calls back into the contract before state updates complete, draining funds

Answer

Reentrancy occurs when an external call lets an attacker re-enter the function before balances or ownership state are finalized.

Question 3

Which pattern best prevents reentrancy in a withdraw function?

Accepted Answer

Checks-Effects-Interactions: update state before making external calls

Answer

Updating internal state before external calls ensures a re-entrant call sees the already-updated state.

Question 4

Why is using tx.origin for authorization in an NFT contract dangerous?

Accepted Answer

A malicious intermediary contract can trick the user into authorizing actions via phishing

Answer

tx.origin is the original EOA, so an intermediary contract the user calls can impersonate the user's authority.

Question 5

What does the OpenZeppelin ReentrancyGuard's nonReentrant modifier do?

Accepted Answer

Sets a lock flag preventing the function from being called again until it completes

Answer

nonReentrant uses a status flag to block recursive calls into guarded functions until the first call returns.

NFT Development Practice Test