Vulnerabilities

NFT Smart Contract Vulnerabilities

NFT smart contract vulnerabilities are bugs that affect NFT ownership, minting, transfers, approvals, metadata, royalties, or marketplace integrations.

These are the bugs that let NFTs be minted, moved, changed, or valued in ways the project did not intend.

NFT Smart Contract Vulnerabilities Explained in Detail

NFT vulnerabilities often sit around ownership and scarcity. The contract promises that only certain users can mint, each token has a valid owner, supply limits hold, and metadata changes follow the rules.

The risky parts are usually not exotic. They are weak mint checks, broad operator approvals, unsafe receiver hooks, mutable metadata, broken allowlists, and marketplace assumptions.

Smart contract example

function mint() external {
    _safeMint(msg.sender, nextId++);
    minted[msg.sender] = true;
}

If _safeMint calls a receiver hook before minted[msg.sender] is set, a malicious receiver may reenter and mint again.

NFT Smart Contract Vulnerabilities in Auditing

NFT contracts can hold meaningful value even when the code is small. A single missed check can break supply caps, token ownership, allowlists, or marketplace safety.

Auditors review NFT contracts with special attention to reentrancy, access control, weak randomness, and Merkle proof usage.

Red flags in code

  • Public minting has no cap, price check, or eligibility check.

  • Metadata can be changed by an unexpected caller.

  • Receiver hooks run before mint limits or ownership state is finalized.

  • setApprovalForAll behavior is customized without careful review.

  • Random token assignment uses predictable block data.

How to test or review it

  • Test unauthorized minting, transfers, burns, and metadata updates.

  • Try reentrancy through ERC721 and ERC1155 receiver hooks.

  • Check supply caps, per-wallet caps, allowlist proofs, and sale phase transitions.

  • Review approval and operator flows used by marketplaces.

  • Verify metadata behavior before mint, after mint, after burn, and after admin updates.

ERC721

ERC721 is the Ethereum token standard for non-fungible tokens where each token ID represents a unique asset with one owner.

ERC1155

ERC1155 is a multi-token standard that supports many fungible and non-fungible token IDs in one contract.

Approval for All

Approval For All is an ERC721 and ERC1155 operator approval that allows one address to transfer all of an owner's tokens for that contract.

Token URI

Token URI is the metadata pointer for an NFT, usually returned by ERC721 tokenURI or ERC1155 uri.

Practice this in real audit scenarios

Definitions help, but auditors need reps. SCH turns concepts like NFT Smart Contract Vulnerabilities into exploit labs, code review habits, and report-writing practice.

Start the free trial or see the full smart contract auditing course.

Sources