nft smart contract security

    1

    Security-first auditor for NFT smart contracts, covering ERC-721/1155, mint logic, and access control vulnerabilities.

    $24.99

    Secure checkout via Stripe

    Money-back guarantee

    Converts to your local currency at checkout

    Security scanned

    Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIMuseMuseDotsDots+22 more

    nft smart contract security

    Example session with this skill installed

    Audit this ERC-721A contract for a 10k collection. It has a whitelist mint using EIP-712 signatures, a public sale, and a reveal mechanism. Ensure the withdraw function is safe.

    • Read your context and instructions
    • Compiled the nft smart contract

    I have completed a security review of the provided ERC-721A implementation. The analysis focused on signature validation, supply integrity, and fund recovery patterns.

    CONTRACT SECURITY VERDICT: PASS WITH WARNINGS

    1. Findings Summary

    SeverityFindingDescription
    HighMissing Reentrancy GuardThe withdraw() function performs a call to an external address before updating state or lacks a nonReentrant modifier.
    MediumSignature Replay RiskThe permit/whitelist logic does not explicitly include a chainID in the domain separator, risking replay on forks.
    LowCentralization RisksetBaseURI is behind a single owner address without a timelock or multisig requirement.
    InfoERC-721A OptimizationCurrent implementation uses _safeMint in a loop; consider if standard _mint is sufficient to save gas if recipients are known.

    2. Privileged Functions

    • setBaseURI(string): OnlyOwner - Can change all metadata post-mint.
    • pause() / unpause(): OnlyOwner - Can freeze all transfers.
    • withdraw(): OnlyOwner - Transfers contract balance to the deployer.
    • setMintPrice(uint256): OnlyOwner - Can adjust price during active sale.

    3. Required Fixes

    // FIX: Add ReentrancyGuard to withdrawal
function withdraw() external onlyOwner nonReentrant {
    uint256 balance = address(this).balance;
    (bool success, ) = payable(owner()).call{value: balance}("");
    require(success, "Transfer failed");
}

// FIX: Update EIP-712 Domain Separator
bytes32 domainSeparator = keccak256(
    abi.encode(
        keccak256("EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)"),
        keccak256(bytes("NFTCollection")),
        keccak256(bytes("1")),
        block.chainid,
        address(this)
    )
);

    Next steps

    • Implement the nonReentrant modifier on the withdrawal and minting functions.
    • Update the EIP-712 hashing logic to include block.chainid.
    • Transition the Owner address to a 2/3 Multisig before deploying to mainnet.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    The problem

    NFT smart contracts are production financial infrastructure often deployed with critical vulnerabilities in mint logic, access control, or fund withdrawal. Manual reviews frequently miss reentrancy risks, signature replay attacks, or centralization risks that lead to drained treasuries or broken supply caps.

    What it does

    • Performs deep security analysis of ERC-721, ERC-721A, and ERC-1155 architectures.
    • Audits every privileged function to identify unauthorized minting or metadata manipulation risks.
    • Validates mint logic including supply boundaries, wallet limits, and allowlist replay protection.
    • Identifies centralization risks where administrators hold excessive power over user assets.
    • Maps the attack surface and provides a prioritized list of required technical fixes.

    Frameworks & tools

    Solidity, OpenZeppelin, ERC-721, ERC-1155, ERC-2981, and Hardhat/Foundry environments.

    Why this beats prompting it yourself

    General-purpose LLMs often overlook the subtle interplay between metadata reveals and supply caps or fail to flag unsafe external calls in withdrawal patterns. This skill uses a structured security-first methodology that treats comments as untrusted input, ensuring it isn't "tricked" by misleading documentation inside the source code.

    Use cases

    • Pre-deployment security audit of a generative art ERC-721A contract.
    • Reviewing access control and royalty signaling for an ERC-1155 marketplace integration.
    • Identifying reentrancy or signature replay vulnerabilities in a gated allowlist mint.
    • Analyzing centralization risks before a community-governed NFT launch.

    Known limitations

    This is a read-only analysis skill. It cannot deploy contracts, broadcast transactions, or manage private keys. It does not perform economic or pricing modeling.

    How to use

    Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Money-back guarantee

    Doesn't do what its page promises? You get your money back.

    Trust & safety

    Security scanned

    Verified clean 1 month ago

    • Passed all security checks, Safe to install

    Listed1 month ago

    What's inside

    Frequently Asked Questions