NFT smart contract audit

C-01Yuga Labs NFT Shadows · Critical

The ownership read reverted for an NFT locked on the target chain. LayerZero’s DVNs could not verify it, which blocked every later read on that channel and stopped ownership syncing.

Cross-chain NFTs Read the finding C-01 in the Yuga Labs NFT Shadows report

NFTR-1NFTR Marketplace · Critical

Moving a name onto an NFT that already had one left the old name pointing at it too. A buyer who paid for “Bob” could receive “Alice”.

Marketplaces Read the finding NFTR-1 in the NFTR Marketplace report

C-01Bigcoin · Critical

Tokens launched through the mining game could finalize once a liquidity cap was met. Donating Bigcoin past the cap let an attacker finalize at once and take the whole miners’ supply.

Game economies Read the finding C-01 in the Bigcoin Protocol Review report

H-01DN404 · High

_mintNext minted IDs still sitting in the burn pool without removing them. The next regular mint reissued those IDs, taking the NFT from the user who held it.

ERC-404 hybrids Read the finding H-01 in the DN404 report

H-01Footium · High

The general minter checked payment against the price of one NFT, whatever the quantity. A buyer could mint several and pay for one.

Mints Read the finding H-01 in the Footium Protocol Review report

H-02Yuga Labs NFT Shadows · High

After an NFT was bridged back to Ethereum, a three-block reorg on the other chain could restore its old shadow owner. One user held an irredeemable shadow while another held the real NFT outside the protocol.

Reorgs Read the finding H-02 in the Yuga Labs NFT Shadows report

H-01NFT Shadows, Round 2 · High

Ownership reads processed against stale state moved delegation from the same old owner twice. Two later owners kept delegation rights, and one could not be revoked.

Delegation Read the finding H-01 in the Yuga Labs NFT Shadows, Round 2 report

H-02INT DAO · High

An NFT burned while boosts were disabled kept its rewards until someone called sync. In between, anyone could mint the same token ID and collect rewards that should have been forfeited.

Rewards Read the finding H-02 in the INT DAO BoostManager, PickCallbackV2 and NftDistributorV2 report

H-01PleasrDAO · High

purchaseWithUSDC lacked the onlyLive modifier, so mints paid in USDC still went through after the contract was disabled.

Sale controls Read the finding H-01 in the PleasrDAO Shaolin Album Tokenization report

C-02Yuga Labs TORCH · Critical

TheSplit’s claimYugaLabs() and claimMachine() were permissionless and paid whatever address the caller passed. Anyone could send the accumulated Yuga Labs and machine splits to themselves.

Payment splits Read the finding C-02 in the Yuga Labs TORCH report

$290MPlayDapp

Using what is believed to be a stolen private key, an attacker minted over 1.79 billion PLA on the gaming platform. The $290M is their market value: Elliptic said they could only be sold far below it, if at all.

Feb 2024 Our coverage of the PlayDapp incident

$216MGala Games

An attacker took a GALA minter account unused for 180 days and minted 5 billion GALA, nominally $216 million. They sold $21.8 million before Gala blocklisted the account; the funds came back the next day.

May 2024 Our coverage of the Gala Games mint