Source-linked AI summary
Understanding Security Issues in the NFT Ecosystem
Dipanjan Das, Priyanka Bose, Nicola Ruaro, Christopher Kruegel, Giovanni Vigna
TL;DR
NFT marketplaces have grown rapidly but have received limited systematic security analysis, despite scams and financial risks. The paper studies eight top marketplaces through ecosystem modeling, multi-source data collection, marketplace analysis, and automated malpractice detection, finding substantial asset losses and widespread wash trading. Its findings provide a security and measurement basis for marketplaces and users while remaining bounded by best-effort data collection and specific detection limitations.
Problem
NFT marketplaces have grown rapidly but remain insufficiently studied for security challenges and associated threats.
Method
The paper analyzes eight top NFT marketplaces using ecosystem modeling, multi-source asset and event data, marketplace investigation, and automated trading-malpractice detection.
Results
$160,761,805 in revenue came from 118,294 transactions involving lost NFTs, while 9,393 wash-trading instances generated $96,858,093 across 5,297 collections.
Takeaways & Limitations
The study offers marketplaces and users a guide to security weaknesses, external-entity risks, and malicious trading behavior in the NFT ecosystem.
Takeaways & Limitations
Asset collection was best-effort and could not enumerate all marketplace listings; bid-shielding detection also incorrectly flags some colluding cases.
Abstract
from arXiv · showhide
Non-Fungible Tokens (NFTs) have emerged as a way to collect digital art as well as an investment vehicle. Despite having been popularized only recently, NFT markets have witnessed several high-profile (and high-value) asset sales and a tremendous growth in trading volumes over the last year. Unfortunately, these marketplaces have not yet received much security scrutiny. Instead, most academic research has focused on attacks against decentralized finance (DeFi) protocols and automated techniques to detect smart contract vulnerabilities. To the best of our knowledge, we are the first to study the market dynamics and security issues of the multi-billion dollar NFT ecosystem. In this paper, we first present a systematic overview of how the NFT ecosystem works, and we identify three major actors: marketplaces, external entities, and users. We perform an in-depth analysis of the top 8 marketplaces (ranked by transaction volume) to discover potential issues associated with such marketplaces. Many of these issues can lead to substantial financial losses. We also collected a large amount of asset and event data pertaining to the NFTs being traded in the examined marketplaces. We automatically analyze this data to understand how the entities external to the blockchain are able to interfere with NFT markets, leading to serious consequences, and quantify the malicious trading behaviors carried out by users under the cloak of anonymity.
1 INTRODUCTION
NFT markets have grown rapidly while receiving limited security scrutiny, creating risks for users and marketplaces. This paper addresses that gap by systematically examining ecosystem actors, marketplace issues, external interference, and user malpractice.
- NFTs record ownership of digital or physical assets on blockchains and offer verifiability and trustless transfer.
- $236M in fees came from OpenSea’s $3.5B trading volume in August 2021, illustrating the scale of NFT markets.
- NFT scams include impersonation, counterfeit collections, fake support channels, account compromise, and rug-pulls.
- Existing research focused mainly on DeFi attacks and automated smart-contract vulnerability detection, leaving NFT ecosystem security largely unexplored.
- The paper systematizes marketplaces, external entities, and users; collects blockchain, asset, and event data; and identifies marketplace design flaws.
2 BACKGROUND
The background defines Ethereum, ERC-721 NFTs, ownership-control methods, and metadata storage. It explains how token records connect blockchain ownership to externally hosted assets.
- Ethereum is a public distributed ledger supporting Ether, decentralized applications, accounts, smart contracts, and transactions.
- ERC-721 is Ethereum’s dominant NFT standard, specifying mandatory and optional token-contract API methods.
- An ERC-721 operator can manage all of an owner’s assets, while a controller can operate on one specified asset.
- The transferFrom() method transfers token _tokenId from the current owner’s _from address to _to.
- metadata_url points to ERC-721-compliant JSON containing asset details and an image_url, linking an NFT to its owned asset.
3 ANATOMY OF THE NFT ECOSYSTEM
The NFT ecosystem connects creators, sellers, buyers, marketplaces, smart contracts, and external hosting services. Marketplace designs differ in how token events, contracts, trading, verification, bids, and royalties are managed.
- Users: Users act as content creators, sellers, or buyers, with creators uploading digital content to external hosting services.
- Marketplaces: NFT marketplaces combine a user-facing frontend with marketplace and token smart contracts that support authentication, minting, listing, and trading.
- Token contracts and collections: NFTs are identified by the pair ⟨token_contract_address,_tokenId⟩, and collections group similar or thematically related NFTs.
- Token contracts and collections: NFTs may use marketplace-managed default or replica contracts, or creator-deployed external contracts imported into the marketplace.
- Trading and verification: Marketplaces support offers and bids, transfer assets after acceptance or settlement, and may verify sellers or collections to increase buyer confidence.
- Royalties: Royalties pay creators on secondary sales through either on-chain marketplace calculation or off-chain marketplace tracking.
4 ANALYSIS APPROACH
The study investigates marketplace weaknesses, external threats, and user fraud using hybrid qualitative-quantitative analysis and quantitative measurements. It examines eight Ethereum marketplaces using asset and event data collected from multiple sources, while acknowledging incomplete coverage.
- The study asks whether NFT marketplace weaknesses are exploitable, how external entities threaten the ecosystem, and whether users cause financial losses through malpractice.
- The authors use a hybrid qualitative-quantitative approach for marketplace weaknesses and quantitative approaches for external threats and user malpractice.
- Eight marketplaces were selected from DappRadar based on Ethereum support and all-time trading volume above $50M as of June 15, 2021.
- Collected data covers NFT assets and marketplace events such as minting, buying, selling, auctions, bids, transfers, and bid acceptance.
- OpenSea contributed 89.63% of dataset assets, with 12.2M of its 18.2M listed assets crawled, representing 66.94% coverage.
5 ISSUES IN NFT MARKETPLACES
The paper identifies marketplace design, verification, transparency, bidding, and royalty practices that can expose NFT marketplaces and users to security, fairness, and financial risks.
- NFT marketplaces were assessed for weaknesses using public incidents, technical reports, marketplace documentation, and direct interactions.The analysis connects identified issues to marketplace activities.
- Identity verification: No examined NFT marketplace enforced KYC or implemented AML/CFT measures, enabling users to create multiple hard-to-trace accounts.
- Token metadata: Changing token metadata can alter the asset pointer after minting, violating buyer expectations about the represented asset.ERC-721 permits metadata changes; marketplace protections vary across internal and external token contracts.
- Principle of least privilege: Escrow-based listing can expose all stored NFTs to compromise through a contract vulnerability or leaked private key.On December 31, 2021, SuperRare, Foundation, and Nifty held 55,640, 79, and 90,988 NFTs in escrow, respectively.
- Caching: 32.30% of OpenSea NFTs had inaccessible image URLs, while cached versions remained available for 68.21% of those inaccessible images.Stale caches can make nonexistent or changed assets appear available to buyers.
- Seller and collection verification: 4.88% of verified and 4.78% of non-verified OpenSea collections were taken down within six months, showing verification did not eliminate abuse.The result indicates that malicious actors still slipped through verification.
- Transparency: Off-chain sales records cannot provide verifiable ownership histories and remain vulnerable to tampering, censorship, and disappearance.Among surveyed marketplaces, only Nifty maintained off-chain records.
- Royalty modification: 157,450 royalty increases occurred across 20,802 collections, representing 8.81% of collections analyzed.
6 ISSUES RELATED TO EXTERNAL ENTITIES
The paper examines whether NFT-linked assets and metadata remain accessible over time, finding substantial dependence on external hosting and meaningful asset loss.
- NFTs are meaningful only when their linked assets remain accessible through metadata and image URLs.ERC-721 tokens may store a metadata_url pointing to JSON that contains an image_url; older tokens may lack an on-chain image URL.
- URL accessibility was checked with HTTP HEAD requests, followed by GET requests after non-200 responses, and repeated three times over 15 days.An asset was marked inaccessible only when all three attempts agreed.
- 3.91% of assets and 9.04% of metadata records hosted on IPFS disappeared between June and December.IPFS-hosted NFTs were less likely to disappear than those hosted on non-IPFS domains.
- 88.71% of asset URLs and 80.69% of metadata URLs were hosted on non-IPFS domains.
- Lost NFTs generated $160,761,805 in revenue across 118,294 transactions.Caching may mean that some lost NFTs remained in circulation.
7 FRAUDULENT USER BEHAVIORS
The paper examines counterfeit NFTs and illicit trading practices across NFT marketplaces, using marketplace and blockchain data to detect and quantify their prevalence. It finds substantial wash trading, shill bidding, and bid shielding, alongside counterfeit collections and duplicated asset URLs.
- Counterfeit NFTs: 322 collection pairs had similar names, and manual inspection of 100 pairs assessed whether replica collections contained misleadingly similar images.The analysis used Levenshtein distance with a maximum difference of two characters, considering collections with names longer than seven characters and at least ten NFTs.
- Counterfeit NFTs: 356,377 IPFS hashes and 2,082,119 non-IPFS URLs had at least one duplicate, indicating widespread reuse of identical asset links.The dataset contained 8,363,550 image URLs, including 944,420 IPFS and 7,419,130 non-IPFS URLs.
- Fraudulent user behaviors: The study analyzes counterfeit NFT creation and three trading malpractices: wash trading, shill bidding, and bid shielding.The models are applied to 13,628,411 assets and 354,535,763 events across the top seven NFT marketplaces.
- Wash trading: 9,393 wash-trading instances generated $96,858,093 in volume across 5,297 collections involving 17,821 users.Among collections exceeding $2K in trading volume, 2,569 of 8,869 (28.97%) showed signs of wash trading.
- Wash trading: 1,571 collections had more than 95% of trades generated by wash trading, totaling $3,407,284 in volume.By contrast, 1,824 collections had less than 5% of trades generated by wash trades; Rarible and OpenSea accounted for 49.30% and 50.43% of detected wash-trade volume, respectively.
- Shill bidding: 703 shill-bidding instances across 282 collections involved 1,211 users and produced $13,014,662 in cumulative seller profit.Foundation’s official collection accounted for 212 instances, or 30.16% of all detected shill bids.
- Bid shielding: 316 bid-shielding instances across 117 OpenSea collections involved 471 users and shielded $942,061 worth of bids.The largest observed difference between colluding bids was $152,606.31, while 113 of 117 collections had fewer than ten instances.
8 RELATED WORK
The paper positions NFT security research within broader work on cryptoeconomic attacks and smart-contract vulnerability detection. It argues that NFT-specific security and privacy risks had not yet received a systematic, comprehensive study.
- Research gap: The paper identifies NFT ecosystem security and privacy risks as an unexplored area requiring systematic and comprehensive analysis.It presents itself as the first in-depth study of these risks.
- Related work: Prior research examined DeFi attacks including transaction reordering, flash-loan abuse, arbitrage, pump-and-dump schemes, and automated smart-contract vulnerability detection.The cited vulnerability work includes reentrancy, transaction-order dependence, integer overflows, and unhandled exceptions.
9 CONCLUSION
The paper conducts the first systematic study of the emerging NFT ecosystem across eight top marketplaces. It combines large-scale data collection with analysis of marketplace weaknesses and models for quantifying trading malpractices.
- Conclusion: The study collects data from Ethereum mainnet, NFT marketplace websites, and documentation across eight top marketplaces.It compiles marketplace and external-entity design weaknesses and develops models to quantify common trading malpractices.
- Conclusion: The analysis provides a comprehensive account of design weaknesses and the prevalence of fraudulent trading practices in NFT marketplaces.The paper reports that these weaknesses often lead to financial consequences.
A CHARTS
The figures track the number of NFTs escrowed by Foundation and Nifty over time.
- Foundation’s escrowed NFT count is plotted over time.
- Together, the charts provide time-series views of escrow activity across two NFT marketplaces.
- Nifty’s escrowed NFT count is plotted over time.
B ANALYSIS OF TOP-15 NFT SALES
The paper evaluates the top 15 NFT sales against desirable NFT marketplace properties, emphasizing verifiability, cryptocurrency payment, and trustless trading. The analysis notes that incomplete blockchain records and escrow designs can make sales opaque or unverifiable.
- Analysis of top sales: The authors analyze the top 15 NFT sales by price against desirable NFT ecosystem properties.They note that collecting information was challenging because no ground-truth source exists.
- Desirable properties: NFT marketplace protocols are expected to preserve blockchain-based verifiability of ownership and transaction history.The ownerOf(_tokenId) API and on-chain transfer events support verification of current and prior ownership.
- Desirable properties: NFT trades are expected to use cryptocurrency payment and support trustless trading.
B.2 Analysis of top sales
The top-sale analysis finds frequent gaps between reported NFT sales and publicly verifiable blockchain records. Escrow contracts and missing or mismatched payment and transfer data prevent confirmation of several high-value transactions.
- Analysis of top sales: $69.3M was the reported value of Beeple’s Everydays sale, but the authors found no blockchain evidence of payment.They found the ownership transfer record but not evidence that the buyer transferred the amount to the seller.
- Analysis of top sales: $11.8M was the reported CryptoPunk #7523 sale amount, but its delayed transfer recorded zero ETH.The transfer occurred more than a month after the reported sale, making the amount impossible to confirm from the transaction.
- Analysis of top sales: Beeple’s CrossRoad and OceanFront lacked public sale or transfer histories because Nifty used an escrow contract.Querying ownerOf(_tokenId) returned the Nifty gateway as the current owner for CrossRoad.
- Analysis of top sales: The advertised payment amounts for WWW source code and Micah’s Replicator were not verifiable from blockchain transfer records.
- Analysis of top sales: Jack Dorsey’s first tweet was sold through Valuables, whose escrow contract made sale and transfer details publicly unavailable.The Polygon token contract returned a platform-owned address as the owner at the time of writing.
USER BEHAVIORS - EXTENDED
The paper examines digital scarcity, front-running, insider trading, and the study’s collected NFT data as aspects of NFT user behavior and ecosystem security. It reports that off-chain rarity metadata weakens enforceability, while automated and insider activity can produce substantial profits.
- Digital scarcity: Digital scarcity requires rarity parameters to be stored on-chain and enforced by the contract against excess minting.
- Digital scarcity: CryptoMotors stores its GEN rarity parameter off-chain in JSON metadata, preventing contract-level enforcement of its claimed 150-car limit.
- Front-running: NFT smart contracts are susceptible to front-running by automated bots monitoring the mempool.
- Front-running: An attacker could profit $111K USD by front-running CryptoKitties’ giveBirth call.
- Study data: The study’s collected NFT and marketplace activity data spans several terabytes and is claimed as a contribution.The authors promised to release the code and dataset upon acceptance.
G DATA COLLECTION
Table 6 details the asset and event data collected from different marketplaces and blockchain sources.
- Table 6 details the types of collected data, covering assets and events.
- The data was collected from different marketplaces and blockchain sources.
- The collection concerns NFT-related assets and events.