Thread by @lucky_hamster

There are a lot of #Security Issues in the #NFT Ecosystem & #NFTs marketplaces (NFTMs)

1/ When using a password-based authentication workflow, there is no #2FA (two-factor authentication)

2/ there is no support #hardwarewallet

3/ The #smartcontracts of NFTMs must be #opensource and/or provide results of security #Audit

4/ Similar to NFTM contracts, token contracts, too, should be open-source and audited. It's more important when an NFTM allows importing tokens developed by third-party developers, as they can be either malicious, or malfunctioning, both posing significant risks to the users.

5/ When an asset sale is executed, the #Ownership of the NFT must be transferred from the seller to the buyer. To this end, the NFTM needs to be a controller: the owner invokes the approve #API on an asset. Being a controller is the most secure.

6/ NFTMs should bids on-chain, for making those verifiable. Off-chain bidding also facilitates abuses like bid shielding and shill bidding, which involve placing spurious bids

7/ Any parameter that the #Frontend receives from a user needs to be sanitized by either the #DAPP itself or the smart contract. Similar to #web applications, parameter validation flaws can lead to loss of NFTs or Ethers.

8/ A malicious creator/owner A can alter the #metadata in two ways:
(i) by changing the metadata_url, and
(ii) by modifying the metadata itself.
This second attack can be prevented if the metadata is hosted in #IPFS.

9/ Most NFTMs, leverage a local caching layer to avoid repeated requests to fetch the images associated with NFT. If the image is updated, or disappears, the cache goes out of sync.

10/ This could trick a buyer into purchasing an NFT for which the asset is either non-existent or different from what the NFTM displays using its stale cache.

11/ All NFTMs implement royalty inside their marketplace contracts or dApps. NFTM users can abuse weaknesses in the #Royalty implementations of these marketplaces in the following ways:

12/ (i) Since NFTMs do not coordinate with each other to enforce cross-platform royalty distribution, a malicious seller can evade royalty by trading the NFT through a platform where royalty is not set.

13/ (ii) Since royalties are not mandated in the token contracts, a malicious seller can evade royalty by transferring (ERC-721 transfer()) the NFT to the buyer, and settling the payment off-chain.

14/ (iii) Some NFTMs allow the modification of the royalty amount even after the primary sale takes place. In a potential abuse scenario, a creator can lure a buyer B by advertising a low royalty, and then immediately increasing it post-sales.

15/ When an NFTM verifies the authenticity of an artist or a collection, this provides credibility and increases buyers trust. But The verification criteria are often vague and at the discretion of the NFTM. Verification has been abused in different ways:

16/ (i) Scammers forged profile pictures with an image of the verification badge overlaid on it, making the profiles appear visually indistinguishable from the verified ones at a cursory glance.

17/ (ii) Scammers got their (fake) profiles verified by just submitting social media handles, without actually proving the ownership of the corresponding accounts.

18/ Thanks to
@sher10ckk
@cinderella0x80
@_ruaronicola
@giovanni_vigna
for great review

and special thanks to @Menaskop and @Envelop_project, I have reached a new level of analysis of #crypto