NFT Smart Contract Security Audits 2

Question 1

A reentrancy vulnerability in an NFT marketplace contract most commonly arises when which pattern is violated?

Accepted Answer

Checks-Effects-Interactions

Answer

Reentrancy occurs when external calls happen before state is updated, violating the Checks-Effects-Interactions ordering.

Question 2

During an audit, you find an ERC-721 mint function using tx.origin for authorization. Why is this a security risk?

Accepted Answer

It can be phished through an intermediary contract

Answer

tx.origin lets a malicious contract relay a legitimate user's call, enabling phishing attacks, so msg.sender should be used instead.

Question 3

Which tool is a symbolic execution engine commonly used to audit Ethereum smart contracts?

Accepted Answer

Mythril

Answer

Mythril uses symbolic execution to detect security vulnerabilities in EVM bytecode.

Question 4

An NFT contract's royalty logic relies on an unbounded loop over all token holders. What audit finding does this represent?

Accepted Answer

Denial-of-service via gas limit

Answer

Unbounded loops can exceed the block gas limit, causing transactions to permanently fail and locking functionality.

Question 5

Why should an audited NFT contract avoid using block.timestamp as a source of randomness for trait assignment?

Accepted Answer

Miners/validators can manipulate it

Answer

Block producers have limited control over the timestamp, making it predictable and exploitable for on-chain randomness.

NFT Development Practice Test