nft smart contract security
Security-first auditor for NFT smart contracts, covering ERC-721/1155, mint logic, and access control vulnerabilities.
$24.99
Works with the AI tools you already use
Claude Code
Cursor
Codex CLI
GitHub Copilot
Gemini CLI+20 moreClaude CodeCursorCodex CLIGitHub CopilotGemini CLI
OpenClaw
Manus
Grok+17 agentsnft smart contract security
Example session with this skill installed
Audit this ERC-721A contract for a 10k collection. It has a whitelist mint using EIP-712 signatures, a public sale, and a reveal mechanism. Ensure the withdraw function is safe.
- Read your context and instructions
- Compiled the nft smart contract
I have completed a security review of the provided ERC-721A implementation. The analysis focused on signature validation, supply integrity, and fund recovery patterns.
CONTRACT SECURITY VERDICT: PASS WITH WARNINGS
1. Findings Summary
| Severity | Finding | Description |
|---|---|---|
| High | Missing Reentrancy Guard | The withdraw() function performs a call to an external address before updating state or lacks a nonReentrant modifier. |
| Medium | Signature Replay Risk | The permit/whitelist logic does not explicitly include a chainID in the domain separator, risking replay on forks. |
| Low | Centralization Risk | setBaseURI is behind a single owner address without a timelock or multisig requirement. |
| Info | ERC-721A Optimization | Current implementation uses _safeMint in a loop; consider if standard _mint is sufficient to save gas if recipients are known. |
2. Privileged Functions
setBaseURI(string): OnlyOwner - Can change all metadata post-mint.pause()/unpause(): OnlyOwner - Can freeze all transfers.withdraw(): OnlyOwner - Transfers contract balance to the deployer.setMintPrice(uint256): OnlyOwner - Can adjust price during active sale.
3. Required Fixes
// FIX: Add ReentrancyGuard to withdrawal
function withdraw() external onlyOwner nonReentrant {
uint256 balance = address(this).balance;
(bool success, ) = payable(owner()).call{value: balance}("");
require(success, "Transfer failed");
}
// FIX: Update EIP-712 Domain Separator
bytes32 domainSeparator = keccak256(
abi.encode(
keccak256("EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)"),
keccak256(bytes("NFTCollection")),
keccak256(bytes("1")),
block.chainid,
address(this)
)
);
Next steps
- Implement the
nonReentrantmodifier on the withdrawal and minting functions. - Update the EIP-712 hashing logic to include
block.chainid. - Transition the
Owneraddress to a 2/3 Multisig before deploying to mainnet.
Connects securely to your tools. The creator never sees your data.
What you get
About this skill
The problem
NFT smart contracts are production financial infrastructure often deployed with critical vulnerabilities in mint logic, access control, or fund withdrawal. Manual reviews frequently miss reentrancy risks, signature replay attacks, or centralization risks that lead to drained treasuries or broken supply caps.
What it does
- Performs deep security analysis of ERC-721, ERC-721A, and ERC-1155 architectures.
- Audits every privileged function to identify unauthorized minting or metadata manipulation risks.
- Validates mint logic including supply boundaries, wallet limits, and allowlist replay protection.
- Identifies centralization risks where administrators hold excessive power over user assets.
- Maps the attack surface and provides a prioritized list of required technical fixes.
Frameworks & tools
Solidity, OpenZeppelin, ERC-721, ERC-1155, ERC-2981, and Hardhat/Foundry environments.
Why this beats prompting it yourself
General-purpose LLMs often overlook the subtle interplay between metadata reveals and supply caps or fail to flag unsafe external calls in withdrawal patterns. This skill uses a structured security-first methodology that treats comments as untrusted input, ensuring it isn't "tricked" by misleading documentation inside the source code.
Use cases
- Pre-deployment security audit of a generative art ERC-721A contract.
- Reviewing access control and royalty signaling for an ERC-1155 marketplace integration.
- Identifying reentrancy or signature replay vulnerabilities in a gated allowlist mint.
- Analyzing centralization risks before a community-governed NFT launch.
Known limitations
This is a read-only analysis skill. It cannot deploy contracts, broadcast transactions, or manage private keys. It does not perform economic or pricing modeling.
How to install
Works the same in every agent - Claude, Cursor, Codex, Copilot and 20+ more.
- 1
Download the ZIP
Free skills download straight away. Paid skills unlock right after purchase.
- 2
Unzip into your skills folder
Every agent reads skills from one folder on your machine. Drop the unzipped folder in there.
- 3
Ask your agent to use it
Restart the agent if it was already running. It picks the skill up automatically - no config needed.
Skills folder by agent
Click the path to copy it. Create the folder if it does not exist yet.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill passes our trust checks below.
Security scanned
Passed our 8-point scan before listing
Fresh listing
Recently published to Agensi
30-day refund
Not a fit? Get your money back
Trust & safety
Security scanned
Verified clean today
- Passed all security checks, Safe to install