Reviewing Nft And Marketplace

Name: Reviewing Nft And Marketplace
Author: nuroctane

ASecurity

Review NFT and marketplace contracts: safeTransfer callbacks, royalty bypass, listing signature replay, payment token weirdness, and enumeration grief. Use for ERC-721/1155 markets and launchpads.

3 stars
0 votes
0 copies
1 view
Added September 2, 2026

ai-agents

Security analysis

A100/100

Scanned September 2, 2026

npx -y skills add nuroctane/nur-cli --skill reviewing-nft-and-marketplace --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Reviewing Nft And Marketplace?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Reviewing Nft And Marketplace

[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/nuroctane-reviewing-nft-and-marketplace/badge)](https://www.skillsdirectory.com/skills/nuroctane-reviewing-nft-and-marketplace)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro

SKILL.md

---
name: reviewing-nft-and-marketplace
description: "Review NFT and marketplace contracts: safeTransfer callbacks, royalty bypass, listing signature replay, payment token weirdness, and enumeration grief. Use for ERC-721/1155 markets and launchpads."
---

# Reviewing NFT and marketplace

In-scope. Callbacks are reentrancy (`reviewing-reentrancy-and-callbacks`). Signatures (`reviewing-signatures-permit-and-eip712`).

## Checklist

- `onERC721Received` / 1155 received during fill: can the buyer re-enter `buy` and get a second NFT?
- Royalty: ERC-2981 skipped on OTC / `transferFrom` bypass.
- Listing sig: nonce, expiry, chainId, cancellations.
- Payment in weird ERC-20 (`reviewing-token-standard-pitfalls`).
- Mint: public `mint` to attacker, merkle proof reuse, `tx.origin` allowlist.
- Enumeration (`tokenOfOwnerByIndex`) unbounded DoS.

Tests: attacker NFT that re-enters on receive; replay listing after cancel.

## Paid bounty analogs

| $ | Protocol | Pack | Writeup |
|---|----------|------|---------|
| $50k | BendDAO sewer-pass flash claim | T32 | [BendDAO](https://medium.com/@BendDAO/sewer-pass-flash-claim-vulnerability-9d2b0b1e09ef) |

BAYC / `setApprovalForAll` phishing is **ops** (`investigator-ops.md`), not this playbook.