Smart Contract Security Audits Flashcards

An audit report classifies findings by severity. A bug allowing anyone to drain all contract funds is typically rated as what?

Answer: Critical

Direct loss of all funds is the highest impact and is rated Critical severity.

Why do auditors recommend emitting events on all state-changing NFT functions?

Answer: To enable off-chain monitoring and incident detection

Events provide an auditable, indexable trail that supports monitoring and post-incident analysis.

A contract verifies an allowlist using a Merkle proof. What is the most common implementation flaw auditors check for?

Answer: Second preimage attacks from unsorted/unprefixed leaves

Improperly constructed Merkle trees can allow forged proofs via second preimage attacks if leaves aren't domain-separated.

What does a 'gas griefing' finding in an NFT batch-transfer function describe?

Answer: An attacker forcing failures by consuming gas in a callback

Gas griefing occurs when a malicious recipient's callback burns gas to cause the caller's transaction to fail.

An auditor recommends a contract pause/circuit-breaker mechanism. What is its main security benefit?

Answer: Halt operations during an active exploit

A pause mechanism lets developers stop activity to contain damage when a vulnerability is being exploited.

Why should an NFT contract validate that _tokenId exists before reading its owner in a custom function?

Answer: To avoid reverts or returning the zero address unexpectedly

Querying a nonexistent token can revert or yield the zero address, causing logic errors if unchecked.

What is the primary value of formal verification in a high-stakes NFT contract audit?

Answer: Mathematically proving properties hold for all inputs

Formal verification proves that specified invariants hold across all possible states, beyond what sampled tests cover.