NFT Smart Contract Security Audits 2

Question 1

A reentrancy vulnerability in an NFT marketplace contract most commonly arises when which pattern is violated?

Accepted Answer

Checks-Effects-Interactions

Answer

Pull-over-Push payments

Answer

Fail-early-fail-loud

Answer

Commit-Reveal

Question 2

During an audit, you find an ERC-721 mint function using tx.origin for authorization. Why is this a security risk?

Accepted Answer

It can be phished through an intermediary contract

Answer

It costs more gas than msg.sender

Answer

It is deprecated in Solidity 0.8

Answer

It cannot be read off-chain

Question 3

Which tool is a symbolic execution engine commonly used to audit Ethereum smart contracts?

Accepted Answer

Mythril

Answer

Hardhat

Answer

Remix Debugger

Answer

Ganache

Question 4

An NFT contract's royalty logic relies on an unbounded loop over all token holders. What audit finding does this represent?

Accepted Answer

Denial-of-service via gas limit

Answer

Integer overflow

Answer

Front-running

Answer

Signature replay

Question 5

Why should an audited NFT contract avoid using block.timestamp as a source of randomness for trait assignment?

Accepted Answer

Miners/validators can manipulate it

Answer

It is always zero on testnets

Answer

It overflows after 2038

Answer

It is not accessible in view functions

Question 6

A reviewer flags that an NFT contract's owner can change the metadata base URI at any time. What is the primary concern?

Accepted Answer

Centralization / rug-pull risk on immutable assets

Answer

Reentrancy

Answer

Gas griefing

Answer

Stack too deep error

Question 7

Which Solidity feature, available since version 0.8.0, removed the need for the SafeMath library in most audits?

Accepted Answer

Built-in arithmetic overflow/underflow checks

Answer

Immutable variables

Answer

Custom errors

Answer

The unchecked keyword