Review NFT and marketplace contracts: safeTransfer callbacks, royalty bypass, listing signature replay, payment token weirdness, and enumeration grief. Use for ERC-721/1155 markets and launchpads.
Scanned 9/2/2026
Install to Claude Code
Skills Directorynpx -y skills add nuroctane/nur-cli --skill reviewing-nft-and-marketplace --agent claude-codeInstalls into .claude/skills of the current project.
Are you the author of Reviewing Nft And Marketplace?
Add the live security badge to your README — it updates automatically with every re-scan.
[](https://www.skillsdirectory.com/skills/nuroctane-reviewing-nft-and-marketplace)More formats (shields.io, HTML) on the badges page.
---
name: reviewing-nft-and-marketplace
description: "Review NFT and marketplace contracts: safeTransfer callbacks, royalty bypass, listing signature replay, payment token weirdness, and enumeration grief. Use for ERC-721/1155 markets and launchpads."
---
# Reviewing NFT and marketplace
In-scope. Callbacks are reentrancy (`reviewing-reentrancy-and-callbacks`). Signatures (`reviewing-signatures-permit-and-eip712`).
## Checklist
- `onERC721Received` / 1155 received during fill: can the buyer re-enter `buy` and get a second NFT?
- Royalty: ERC-2981 skipped on OTC / `transferFrom` bypass.
- Listing sig: nonce, expiry, chainId, cancellations.
- Payment in weird ERC-20 (`reviewing-token-standard-pitfalls`).
- Mint: public `mint` to attacker, merkle proof reuse, `tx.origin` allowlist.
- Enumeration (`tokenOfOwnerByIndex`) unbounded DoS.
Tests: attacker NFT that re-enters on receive; replay listing after cancel.
## Paid bounty analogs
| $ | Protocol | Pack | Writeup |
|---|----------|------|---------|
| $50k | BendDAO sewer-pass flash claim | T32 | [BendDAO](https://medium.com/@BendDAO/sewer-pass-flash-claim-vulnerability-9d2b0b1e09ef) |
BAYC / `setApprovalForAll` phishing is **ops** (`investigator-ops.md`), not this playbook.
Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.
No comments yet. Be the first to comment!
Ultra-compressed communication mode. Cuts token usage ~75% by speaking like caveman while keeping full technical accuracy. Supports intensity levels: lite, full (default), ultra, wenyan-lite, wenyan-full, wenyan-ultra. Use when user says "caveman mode", "talk like caveman", "use caveman", "less tokens", "be brief", or invokes /caveman. Also auto-triggers when token efficiency is requested.
Adversarial multi-agent planning skill. Self-orchestrates 5 hostile category members (unspecified-low, unspecified-high, deep, ultrabrain, artistry) via team-mode for ruthless cross-critique debate, distills only the defensible insights, then MANDATORILY hands the distilled insight bundle to the `plan` agent for executable plan formalization. Use when planning needs maximum rigor and surfacing of weak assumptions, blind spots, and over-engineering. Triggers: 'hyperplan', 'hpp', '/hyperplan', ...
**Complete production-ready guide for Google Gemini embeddings API** This skill provides comprehensive coverage of the `gemini-embedding-001` model for generating text embeddings, including SDK usage, REST API patterns, batch processing, RAG integration with Cloudflare Vectorize, and advanced use cases like semantic search and document clustering. ---
Interview, source-challenge, verify, save, and ADR-gate fuzzy coding requests into Codex-ready implementation specs. Use when a feature, bugfix, refactor, migration, repo-wide change, or architecture task needs user-verified requirements, source-backed decisions, durable architecture decisions, acceptance criteria, validation commands, rollout notes, saved spec/ADR files, and a Codex execution prompt. Do not use when already fully specified or when the user wants direct implementation now.
Use when a repo needs CodeGraph plus ast-grep for Codex MCP setup, exploration, impact analysis, structural search, or safe refactor planning.
