NFT and marketplace audits
An NFT audit checks minting, ownership and transfer logic, royalties, metadata control and, for marketplaces, listing, bidding and settlement. HYDN looks for supply and allowlist bypasses, callback reentrancy through onERC721Received, signature replay on off-chain orders, and auction logic that lets an asset or a payment be taken twice.
Collections
- Mint limits per wallet and in total, and whether they can be bypassed with multiple calls or contracts.
- Allowlists built on Merkle proofs or signatures, and whether a proof or signature can be reused.
- Reveal mechanics and randomness.
- Who can change metadata, and whether that is disclosed.
- Royalty logic and withdrawal of mint proceeds.
Marketplaces
- Orders and signatures. Off-chain orders must be bound to a chain, a contract, a nonce and an expiry, or they can be replayed. See signature replay attacks.
- Auctions. Bidding, minimum durations, refunds of outbid bidders, and settlement that checks the auction has not already been taken before moving the NFT and the payment.
- Callbacks. Safe transfer functions call into the receiving contract, which is a reentrancy path if state is updated afterwards.
- Approvals. Marketplace contracts often hold approvals over users’ whole collections, which makes their access control critical.
Our Position Exchange vulnerability report walks through an auction settlement flaw of exactly this kind, found in a live contract.
Questions
Frequently asked questions
Have you found vulnerabilities in NFT marketplaces before?
Yes. Our published Position Exchange report describes an auction settlement flaw our team found in a deployed NFT auction contract, and how it was fixed.
Do you audit ERC-1155 as well as ERC-721?
Yes, along with custom token standards built on either.
Published Updated