Understanding Security Issues in the NFT Ecosystem

Abstract

Non-Fungible Tokens (NFTs) have emerged as a way to collect digital art as well as an investment vehicle. Despite having been popularized only recently, over the last year, NFT markets have witnessed several high-profile (and high-value) asset sales and a tremendous growth in trading volumes. However, these marketplaces have not yet received much scrutiny. Most academic researchers have analyzed decentralized finance (DeFi) protocols, studied attacks on those protocols, and developed automated techniques to detect smart contract vulnerabilities. To the best of our knowledge, we are the first to study the market dynamics and security issues of the multi-billion dollar NFT ecosystem.In this paper, we first present a systematic overview of how the NFT ecosystem works, and we identify three major actors: marketplaces, external entities, and users. We study the design of the underlying protocols of the top 8 marketplaces (ranked by transaction volume) and discover security, privacy, and usability issues. Many of these issues can lead to substantial financial losses. During our analysis, we reported 5 security bugs in 3 top marketplaces; all of them have been confirmed by the affected parties. Moreover, we provide insights on how the entities external to the blockchain are able to interfere with NFT markets, leading to serious consequences. We also collect a large amount of asset and event data pertaining to the NFTs being traded in the examined marketplaces, and we quantify malicious trading behaviors carried out by users under the cloak of anonymity. Finally, we studied the 15 most expensive NFT sales to date, and discovered discrepancies in at least half of these transactions.

Incorporating Registration, Reputation, and Incentivization Into the NFT Ecosystem

“…The study conducted in [12] concentrates on the market dynamics and security issues of the NFT ecosystem, particularly on the 8 NFTMs. Their research discovered bugs in several marketplaces, as well as malicious trading between users and discrepancies among some of the most expensive sales in the NFT trade.…”

“…Collusion Attacks: A collusion attack is a common attack that takes place when two or more peers cooperate together to take down the reputation of a certain targeted peer [12]. It can also take place in the opposite way, where it can be used to increase the reputation of a specific seller or user.…”

“…Sybil Attack: This attack takes place when the system allows a single user to create multiple accounts with multiple identities. Hence, several identities on the system are associated with a single person physically [27] [12]. We address this problem by registering all users on the chain and off the chain.…”

“…A malicious user can act poorly and lower the reputation score a lot. Hence, this might incentivize the user to leave the current account and create a new one to have a fresh start with a better reputation [27], [12]. Creating a new account in our system is associated with real identities and off-chain registration.…”

“…However, just before the end of the auction, the highest bidder withdraws from the auction, allowing the user with the lowest bid to buy the NFT. This attack can allow two malicious users, the auction winner and the bid shielder, to control the auction and the NFT price [12]. In our solution, all bidders are required to pay for their bids once they place them, and they cannot withdraw from the auction once they have placed their bids.…”