LogoNFT2
NFT2

Security

Last updated 2026-10-12 · nft2.club

How the NFT2 smart contracts and API were checked, what was found and fixed, and what each privileged wallet can and cannot do.

Internal audit by the NFT2 team, 2026-10-12. This is not an independent third-party audit. It checks the code for technical weaknesses; it does not judge the token design, prices or fees. No audit can guarantee that code is free of bugs.

01Summary

Found

19

Fixed

13

Open

0

SeverityFoundFixedAcknowledged
Critical110
High550
Medium431
Low642
Informational303

Acknowledged items are risks the team has accepted with a reason; they are counted here but not described until they are resolved. Informational items have no security impact.

02What was checked, and how

  • NFT2.solThe collection: paid and airdrop mints, tier reveal, go-live, liquidation
  • accretiveToken_v2.solThe collection token: capped at 21M, minted only on payout
  • NFT2Staking.solStaking for the collection token
  • launchpad_v4.solBonding-curve sales in USDT, refunds, go-live into Uniswap V3
  • NFT2Liquidator.solBurn an NFT2 and swap the payout in one transaction
  • MarketplaceEngine.sol, MarketplaceConduit.solGasless listings and tier offers
  • Backend APISign-in, admin access, airdrop signatures, uploads, market data

Not in scope: Business design: token split, prices, fees, tier weights and the halving schedule; Legacy contracts (launchpad v2/v3, the v1 token) and test tokens; The website's own code (beyond the wallet-signing flows it drives).

Every contract was scanned with two static analysers and reviewed line by line for access control, reentrancy, rounding, signatures, Uniswap and USDT integration, price manipulation, denial of service and randomness. Every finding has a test that reproduced it; after each fix the same test proves the attack fails.

Slither 0.11.4

Static analysis, 100 detectors, every in-scope contract

Aderyn 0.6.8

Second static analyser with different detectors

Foundry fork tests

70 tests against Ethereum mainnet and Sepolia state, including a proof for every finding

Foundry invariant tests

Token and staking rules checked across 128,000 random calls

npm audit

Backend dependencies

03Fixed findings

C-01CriticalFixedA listing could be filled as an offer

Issue. Listings and offers were signed in the same format, so a seller's public listing could be submitted as a buy offer and the seller charged their own price.

Fix. Listings and offers are now different signed types, and the new marketplace engine refuses any old signature.

H-01HighFixedMinters could choose their tier

Issue. The tier was decided inside the mint transaction, so a contract could undo every mint that did not roll the top tier.

Fix. Tiers now come from the two blocks after the mint, which do not exist while the mint runs; they appear about 36 seconds later.

H-02HighFixedA creator deploying directly could burn holders' NFTs

Issue. The deploying wallet became a collection owner, and owners could burn any NFT after go-live and keep the payout.

Fix. Only the launchpad is an owner, every burn needs the holder's permission, and payouts always go to the holder.

H-03HighFixedOffers did not check the tier on-chain

Issue. An offer for a top-tier NFT could be filled with a common one.

Fix. Offers sign the tier and the engine checks every token's tier before settling.

H-04HighFixedAn old sign-in route accepted any signed message

Issue. A retired wallet sign-in route accepted a signature made for any other site.

Fix. The old routes were removed; sign-in only accepts the message the server issued, once.

H-05HighFixedListing tiers were taken on trust

Issue. A seller could list an NFT under a rarer tier than it is.

Fix. The server reads the tier from the chain before accepting a listing, and every purchase checks it again.

M-02MediumFixedMarketplace token transfers were unchecked

Issue. USDT purchases could not settle, and a token that reports failure quietly could deliver an NFT unpaid.

Fix. Every payment uses OpenZeppelin SafeERC20; real USDT settlement is tested on a mainnet fork.

M-03MediumFixedMarket data could be written without signing in

Issue. Trade records and the coin price chart accepted unauthenticated writes.

Fix. The unused routes were removed and the server now reads coin prices from the Uniswap pools itself.

M-04MediumFixedAirdrop signatures could be collected repeatedly

Issue. Releasing an unused airdrop signature returned the credit while the signature stayed valid.

Fix. An unused signature is handed back as-is instead of a new one being issued.

L-01LowFixedUpload limits

Issue. Uploads had no size limit and the image host accepted SVG.

Fix. Uploads are capped and limited to raster images.

L-02LowFixedDependency advisories

Issue. Two backend packages had published advisories.

Fix. Both were updated.

L-03LowFixedLong sessions

Issue. Sign-in sessions lasted a year.

Fix. Sessions now last 30 days.

L-04LowFixedDevelopment origins in production

Issue. The API accepted requests from localhost pages in production.

Fix. Those origins are only allowed outside production.

04Who can do what

Every privileged role, in plain words. Anything not listed here is not possible for that role.

Launchpad · Owner wallets

Can: Change the treasury wallet, the AGB paired per collection and the owner list; withdraw AGB and other free tokens.

Cannot: Touch USDT owed to buyers, creators or the treasury, or the tokens of collections not yet live.

NFT2 collection · The launchpad only

Can: Mint on the curve, take the collection live, set the airdrop signer.

Cannot: Burn or move anyone's NFT, or choose a tier.

NFT2 collection · The creator

Can: Close the airdrop early; set the royalty (up to 10%).

Cannot: Mint, burn, or change tiers.

Collection token and staking · Nobody

Can: No owner and no admin functions; new tokens are minted only on the release schedule, within the 21M cap.

Marketplace · Conduit owner

Can: Authorise which engine may settle trades; claim the 0.25% marketplace fee.

Cannot: Move assets except through an authorised engine executing a user's signed order.

Liquidator · Nobody

Can: No owner; holds nothing between transactions.

Creators are responsible for the IP and art they launch. NFT2 does not verify who owns the rights to a collection, and the launchpad accepts any collection.

05Deployed contracts

Verify any address on the network's block explorer before you interact with it.

Ethereum
  • Launchpad (AGB)Not deployed yet
  • Marketplace engineNot deployed yet
  • Marketplace conduitNot deployed yet
  • LiquidatorNot deployed yet
SepoliaTestnet

06Report a vulnerability

Email security@nft2.club with a description and, if you can, steps or a test that reproduces it. Please do not test against mainnet funds or other users, and give us reasonable time to fix an issue before disclosing it.

We will not pursue anyone who reports in good faith, avoids harming users or their data, and follows these steps.