Introduction
NFT contracts have become high-value targets for attackers. This guide covers the most common vulnerabilities we find in NFT audits and how to prevent them.
Minting Vulnerabilities
- Unrestricted minting allowing unlimited token creation
- Signature replay attacks in whitelist minting
- Front-running of mint transactions
- Integer overflow in mint count tracking
SecureMint.sol
// Secure whitelist minting with signature verificationfunction whitelistMint(uint256 quantity, bytes calldata signature) external payable { require(!usedSignatures[signature], "Signature already used"); require( _verifySignature(msg.sender, quantity, signature), "Invalid signature" ); usedSignatures[signature] = true; _safeMint(msg.sender, quantity);}Always mark signatures as used before minting to prevent replay attacks.
Mint Controls
Proper access control and limits
Signature Security
Prevent replay attacks
Metadata
Secure on-chain or IPFS storage