NFT

NFT¶

Versions¶

ERC-20 Schema:
ERC20 tokens are basically what we will call “Fungible Tokens”. Fungibility is the ability of a good or asset to be readily interchanged for another of like kind. Think of two 1 dollar notes. Both the notes are different, but their value is exactly the same. The same is the case in an ERC20 token. Each token is worth the exact same as the other tokens in value.

ERC-721 Schema:
ERC721 are what are called "Non-Fungible tokens"

{
  "name": "Buzz",
  "description": "Paper collage, using salvaged and original watercolour papers", 
  "image": "https://ipfs.infura.io/ipfs/QmWc6YHE815F8kExchG9kd2uSsv7ZF1iQNn23bt5iKC6K3/image",
  "meta": "https://ipfs.infura.io/ipfs/QmWc6YHE815F8kExchG9kd2uSsv7ZF1iQNn23bt5iKC6K3/other"
}

ERC-1155:
ERC-1155 allows you to create Fungible, Non-Fungible, and Semi-Fungible in one single token standard. Both Fungible and Non-Fungible tokens can be created using the same standard.

{
    "title": "Token Metadata",
    "type": "object",
    "properties": {
        "name": {
            "type": "string",
            "description": "Identifies the asset to which this token represents"
        },
        "decimals": {
            "type": "integer",
            "description": "The number of decimal places that the token amount should display - e.g. 18, means to divide the token amount by 1000000000000000000 to get its user representation."
        },
        "description": {
            "type": "string",
            "description": "Describes the asset to which this token represents"
        },
        "image": {
            "type": "string",
            "description": "A URI pointing to a resource with mime type image/* representing the asset to which this token represents. Consider making any images at a width between 320 and 1080 pixels and aspect ratio between 1.91:1 and 4:5 inclusive."
        },
        "properties": {
            "type": "object",
            "description": "Arbitrary properties. Values may be strings, numbers, object or arrays."
        }
    }
}

Inter Planetary File System (IPFS)¶

is a protocol and peer-to-peer network for storing and sharing data in a distributed file system. IPFS uses content-addressing to uniquely identify each file in a global namespace connecting all computing devices.

The most Secure way to store info using IPFS is to pin the hash to a specific node that you host the file on.

Security¶

NFT are Files and they contain their own security issues. The most common files are Image and Video. These may contain SSRF, XSS and other types of issues when providing it to a user.

Known Attacks:
https://timdaub.github.io/2021/04/22/nft-sleepminting-beeple-provenance/
https://twitter.com/kelvinfichter/status/1489041221947375616?t=U21D7BqJr951KfKUiTHUmA&s=09
https://research.kudelskisecurity.com/2022/02/03/quick-analysis-of-the-wormhole-attack/
https://marketrealist.com/p/wormhole-hack-explained/

Pshing Attacks¶

setApprovalForAll Attack

NFT Specific Security¶

Roles and permissions of owners/controllers/etc. address do not impact ownership of NFTs.
Required ownership and balance checks are implemented via ownerOf(uint256) and balanceOf(address) and marked as view.
No mechanisms (e.g. require() in modifiers) that can make calls to balanceOf(address) or ownerOf(uint256) fail. Unless the tokenId is invalid.
If minting is implemented, it emits the regular NFT transfer event, and specifies the zero-address as from address.
- This is not required in EIP-721 but are conditions of EIP-1155.
If burning is implemented, it emits the regular NFT transfer event, and specifies the zero-address as to address.
- This is not required in EIP-721 but are conditions of EIP-1155.

NFT

NFT¶

Versions¶

Inter Planetary File System (IPFS)¶

Security¶

Pshing Attacks¶

NFT Specific Security¶

ETH Smart Contracts Security¶

NFT Metadata and Links¶

Solana Smart Contracts¶