NFT Smart Contract Security Audits 2 — Questions and Answers
Question 1: A reentrancy vulnerability in an NFT marketplace contract most commonly arises when which pattern is violated?
- Checks-Effects-Interactions (Correct answer)
- Pull-over-Push payments
- Fail-early-fail-loud
- Commit-Reveal
Correct answer: Checks-Effects-Interactions
Reentrancy occurs when external calls happen before state is updated, violating the Checks-Effects-Interactions ordering.
Question 2: During an audit, you find an ERC-721 mint function using tx.origin for authorization. Why is this a security risk?
- It can be phished through an intermediary contract (Correct answer)
- It costs more gas than msg.sender
- It is deprecated in Solidity 0.8
- It cannot be read off-chain
Correct answer: It can be phished through an intermediary contract
tx.origin lets a malicious contract relay a legitimate user's call, enabling phishing attacks, so msg.sender should be used instead.
Question 3: Which tool is a symbolic execution engine commonly used to audit Ethereum smart contracts?
- Mythril (Correct answer)
- Hardhat
- Remix Debugger
- Ganache
Correct answer: Mythril
Mythril uses symbolic execution to detect security vulnerabilities in EVM bytecode.
Question 4: An NFT contract's royalty logic relies on an unbounded loop over all token holders. What audit finding does this represent?
- Denial-of-service via gas limit (Correct answer)
- Integer overflow
- Front-running
- Signature replay
Correct answer: Denial-of-service via gas limit
Unbounded loops can exceed the block gas limit, causing transactions to permanently fail and locking functionality.
Question 5: Why should an audited NFT contract avoid using block.timestamp as a source of randomness for trait assignment?
- Miners/validators can manipulate it (Correct answer)
- It is always zero on testnets
- It overflows after 2038
- It is not accessible in view functions
Correct answer: Miners/validators can manipulate it
Block producers have limited control over the timestamp, making it predictable and exploitable for on-chain randomness.
Question 6: A reviewer flags that an NFT contract's owner can change the metadata base URI at any time. What is the primary concern?
- Centralization / rug-pull risk on immutable assets (Correct answer)
- Reentrancy
- Gas griefing
- Stack too deep error
Correct answer: Centralization / rug-pull risk on immutable assets
Mutable metadata controlled by a single owner undermines the claimed immutability of the NFT and is a centralization risk.
Question 7: Which Solidity feature, available since version 0.8.0, removed the need for the SafeMath library in most audits?
- Built-in arithmetic overflow/underflow checks (Correct answer)
- Immutable variables
- Custom errors
- The unchecked keyword
Correct answer: Built-in arithmetic overflow/underflow checks
Solidity 0.8.0 added automatic reverting on overflow and underflow, making SafeMath largely redundant.
NFT Smart Contract Security Audits 2
A reentrancy vulnerability in an NFT marketplace contract most commonly arises when which pattern is violated?