NFT Smart Contract Security Audits 3 — Questions and Answers
Question 1: A signature-based NFT mint allowlist is found to be replayable across chains. Which EIP standard prevents this when implemented correctly?
- EIP-712 with chainId in the domain separator (Correct answer)
- EIP-165
- EIP-2981
- EIP-1155
Correct answer: EIP-712 with chainId in the domain separator
EIP-712 domain separators include chainId, binding signatures to a specific chain and preventing cross-chain replay.
Question 2: During an audit you notice a withdraw() that sends ETH using transfer(). What is the modern best-practice concern?
- transfer's 2300 gas stipend can break with future opcode repricing (Correct answer)
- transfer is more expensive than send
- transfer cannot send to EOAs
- transfer reverts on zero value
Correct answer: transfer's 2300 gas stipend can break with future opcode repricing
The fixed 2300 gas stipend of transfer may fail for contract recipients after gas cost changes, so call with checks is preferred.
Question 3: An auditor finds that an NFT contract inherits Ownable but never calls renounceOwnership or uses a multisig. What recommendation is most appropriate?
- Transfer ownership to a timelock or multisig (Correct answer)
- Remove all access control
- Make every function external
- Add tx.origin checks
Correct answer: Transfer ownership to a timelock or multisig
Concentrated owner privileges should be mitigated by a multisig or timelock to reduce single-point-of-failure risk.
Question 4: Which static analysis tool by Trail of Bits is widely used for auditing Solidity contracts?
- Slither (Correct answer)
- Truffle
- Foundry
- Geth
Correct answer: Slither
Slither is a static analysis framework that detects vulnerabilities and code-quality issues in Solidity.
Question 5: An ERC-1155 batch transfer fails to validate that the recipient implements onERC1155Received. What risk does this create?
- Tokens permanently locked in a non-receiver contract (Correct answer)
- Reentrancy
- Overflow
- Front-running
Correct answer: Tokens permanently locked in a non-receiver contract
Without the receiver hook check, tokens sent to incompatible contracts can become irretrievable.
Question 6: A reviewer identifies that the mint price is read from a public storage variable an owner can change mid-transaction batch. This enables what attack?
- Front-running / price manipulation (Correct answer)
- Integer underflow
- Selfdestruct
- Delegatecall injection
Correct answer: Front-running / price manipulation
An owner observing the mempool can change the price before a user's transaction confirms, manipulating what buyers pay.
Question 7: What does the 'unchecked' block in Solidity 0.8+ do that auditors must scrutinize?
- Disables overflow/underflow checks for gas savings (Correct answer)
- Disables reentrancy guards
- Skips access control
- Forces a revert
Correct answer: Disables overflow/underflow checks for gas savings
unchecked blocks remove automatic arithmetic safety checks, reintroducing overflow risk if used incorrectly.
NFT Smart Contract Security Audits 3
A signature-based NFT mint allowlist is found to be replayable across chains.
Which EIP standard prevents this when implemented correctly?