An NFT auditing involves trained professionals manually examining the code and utilizing various in-house toolings to support discovering vulnerabilities.

NFTs are smart contracts, usually following a standard such as ERC-721 or ERC-1155 on Ethereum. It is crucial to review the contract’s adherence to these standards, in terms of e.g. transfers and auctions.

These standards come with their own set of attack vectors that need special focus. For example, the use of receiver hooks prevents lost tokens, but can easily introduce reentrancies when minting or transferring tokens. Batch operations need especially careful review to avoid reentrancy and DoS attacks.

Ownership validation is also critical with NFTs, ensuring the smart contract logic accurately updates the ownership transfers and verifies the authenticity of the asset. Potential marketplace integrations need to be carefully audited, as well as NFT releases and airdrops. Many NFT airdrops rely on signature validation, which can be prone to replays, or lead to theft if the interactions with NFT transfers lead to reentrancy.

The choice of standard itself is another important design point. Developers may take on extra code complexity by using ERC1155, but also save on gas if they intend to manage several different NFTs. These myriad of concerns all must be carefully considered from both a cost and security perspective when designing a protocol.