NFT Smart Contract Security Audits 3

Question 1

A signature-based NFT mint allowlist is found to be replayable across chains. Which EIP standard prevents this when implemented correctly?

Accepted Answer

EIP-712 with chainId in the domain separator

Answer

EIP-712 domain separators include chainId, binding signatures to a specific chain and preventing cross-chain replay.

Question 2

During an audit you notice a withdraw() that sends ETH using transfer(). What is the modern best-practice concern?

Accepted Answer

transfer's 2300 gas stipend can break with future opcode repricing

Answer

The fixed 2300 gas stipend of transfer may fail for contract recipients after gas cost changes, so call with checks is preferred.

Question 3

An auditor finds that an NFT contract inherits Ownable but never calls renounceOwnership or uses a multisig. What recommendation is most appropriate?

Accepted Answer

Transfer ownership to a timelock or multisig

Answer

Concentrated owner privileges should be mitigated by a multisig or timelock to reduce single-point-of-failure risk.

Question 4

Which static analysis tool by Trail of Bits is widely used for auditing Solidity contracts?

Accepted Answer

Slither

Answer

Slither is a static analysis framework that detects vulnerabilities and code-quality issues in Solidity.

Question 5

An ERC-1155 batch transfer fails to validate that the recipient implements onERC1155Received. What risk does this create?

Accepted Answer

Tokens permanently locked in a non-receiver contract

Answer

Without the receiver hook check, tokens sent to incompatible contracts can become irretrievable.

NFT Development Practice Test