Non Fungible Token Security And Authenticity Verification — Complete Documentation & Simulation

Overview & System Context

Non Fungible Token Security And Authenticity Verification: Comprehensive Web-Sourced Technical Investigation Exhaustive Research Dossier · Pure Web-Scraped Content: ~9585 Words · Real Software Screenshots: 1 1. Executive Overview & Technical Background A non-fungible token (NFT) is a unique digital identifier that is recorded on a blockchain and is used to certify ownership and authenticity. They typically contain references to digital files such as artworks, photos, videos, and audio. Because NFTs are uniquely identifiable, they differ from cryptocurrencies (which are fungible, hence the name non-fungible token), and as a result they cannot be copied, substituted, or subdivided. Their ownership can be transferred by the owner, allowing NFTs to be sold and traded. Initially pitched in 2017 as a new class of investment asset, NFT trading increased from US$82 million in 2020 to US$17 billion in 2021. Its market was occasionally compared to an economic bubble or a Ponzi scheme. In 2022, the NFT market collapsed; a May 2022 estimate was that the number of sales was down over 90% compared to 2021. By September 2023 one report claimed that over 95% of NFT collections had zero monetary value. Proponents claim that NFTs provide a public certificate of authenticity or proof of ownership, but the legal rights conveyed by an NFT can be uncertain.

The ownership of an NFT as defined by the blockchain has no inherent legal meaning and does not necessarily grant copyright, intellectual property rights, or other legal rights over its associated digital file. An NFT does not restrict the sharing or copying of its associated digital file and does not prevent the creation of NFTs that reference identical files. NFTs have been used as speculative investments and have drawn criticism for the energy cost and carbon footprint associated with some types of blockchain, as well as their use in art scams.

An NFT solely represents a proof of ownership of a blockchain record and does not necessarily imply that the owner possesses intellectual property rights to the digital asset the NFT purports to represent. Someone may sell an NFT that represents their work, but the buyer will not necessarily receive copyright to that work, and the seller may not be prohibited from creating additional NFT copies of the same work. According to legal scholar Rebecca Tushnet, "In one sense, the purchaser acquires whatever the art world thinks they have acquired. They definitely do not own the copyright to the underlying work unless it is explicitly transferred." Certain NFT projects, such as Bored Apes, explicitly assign intellectual property rights of individual images to their respective owners. The NFT collection CryptoPunks was a project that initially prohibited owners of its NFTs from using the associated digital artwork for commercial use, but later allowed such use upon acquisition by the collection's parent company.

Digital art is a common use case for NFTs. High-profile auctions of NFTs linked to digital art have received considerable public attention; the first such major house auction took place at Christie's in 2021. The work entitled Merge by artist Pak was the most expensive NFT, with an auction price of US$91.8 million and Everydays: the First 5000 Days, by artist Mike Winkelmann (known professionally as Beeple) the second most expensive at US$69.3 million in 2021.

Some NFT collections, including Bored Apes, EtherRocks, and CryptoPunks, are examples of generative art, where many different images are created by assembling a selection of simple picture components in different combinations. In March 2021, the blockchain company Injective Protocol bought a $95,000 original screen print entitled Morons (White) from English graffiti artist Banksy and filmed somebody burning it with a cigarette lighter. They uploaded (known as "minting" in the NFT scene) and sold the video as an NFT. The person who destroyed the artwork, who called themselves "Burnt Banksy", described the act as a way to transfer a physical work of art to the NFT space. American curator and art historian Tina Rivers Ryan, who specializes in digital works, said that art museums are widely not convinced that NFTs have "lasting cultural relevance." Ryan compares NFTs to the net art fad before the dot-com bubble. In July 2022, after the controversial sale of Michelangelo's Doni Tondo in Italy, the sale of NFT reproductions of famous artworks was prohibited in Italy. Given the complexity and lack of regulation of the matter, the Ministry of Culture of Italy temporarily requested that its institutions refrain from signing contracts involving NFTs. No centralized means of authentication exists to prevent stolen and counterfeit digital works from being sold as NFTs, although auction houses like Sotheby's, Christie's, and various museums and galleries worldwide started collaborations and partnerships with digital artists such as Refik Anadol, Dangiuz and Sarah Zucker. NFTs associated with digital artworks could be sold and bought via NFT platforms. OpenSea, launched in 2017, was one of the first marketplaces to host various types of NFTs. In July 2019, the National Basketball Association, the NBA Players Association and Dapper Labs, the creator of CryptoKitties, started a joint venture NBA Top Shot for basketball fans that let users buy NFTs of historic moments in basketball. In 2020, Rarible was found, allowing multiple assets. In 2021, Rarible and Adobe formed a partnership to simplify the verification and security of metadata for digital content, including NFTs. In 2021, a cryptocurrency exchange Binance, launched its NFT marketplace. In 2022, eToro Art by eToro was founded, focusing on supporting NFT collections and emerging creators. Sotheby's and Christie's auction houses showcase artworks associated with the respective NFTs both in virtual galleries and physical screens, monitors, and TVs. Mars House, an architectural NFT created in May 2020 by artist Krista Kim, sold in 2021 for 288 Ether (ETH) — at that time equivalent to US$524,558.

Figure 1: Video Demonstration & Practical Interface Overview NFTs can represent in-game assets. Some commentators describe these as being controlled "by the user" instead of the game developer if they can be traded on third-party marketplaces without permission from the game developer. Their reception from game developers, though, has been generally mixed, with some like Ubisoft embracing the technology but Valve and Microsoft formally prohibiting them.

CryptoKitties was an early successful blockchain online game in which players adopt and trade virtual cats. The monetization of NFTs within the game raised a $12.5 million investment, with some kitties selling for over $100,000 each. Following its success, CryptoKitties was added to the ERC-721 standard, which was created in January 2018 (and finalized in June). In October 2021, Valve Corporation banned applications from their Steam platform if those applications use blockchain technology or NFTs to exchange value or game artifacts. In December 2021, Ubisoft announced Ubisoft Quartz, "an NFT initiative which allows people to buy artificially scarce digital items using cryptocurrency". The announcement was heavily criticized by audiences, with the Quartz announcement video attaining a dislike ratio of 96% on YouTube. Ubisoft subsequently unlisted the video from YouTube. The announcement was also criticized internally by Ubisoft developers. The Game Developers Conference's 2022 annual report stated that 70 percent of developers surveyed said their studios had no interest in integrating NFTs or cryptocurrency into their games. Some luxury brands minted NFTs for online video game cosmetics. In November 2021, investment firm Morgan Stanley published a note claiming that this could become a US$56 billion market by 2030. In July 2022, Mojang Studios announced that NFTs would not be permitted in Minecraft, saying that they went against the game's "values of creative inclusion and playing together".

In May 2018, 20th Century Fox partnered with Atom Tickets and released limited-edition Deadpool 2 digital posters to promote the film. They were available from OpenSea and the GFT exchange. In March 2021, Adam Benzine's 2015 documentary Claude Lanzmann: Spectres of the Shoah became the first motion picture and documentary film to be auctioned as an NFT. Other examples of NFTs being used in the film-industry include a collection of NFT-artworks for Godzilla vs. Kong, the release of both Kevin Smith's horror-movie KillRoy Was Here, and the 2021 film Zero Contact as NFTs in 2021. In September 2021, Shakira released an NFT collection named La Caldera, which features four pieces each with animated digital art and an audio piece produced by Shakira. In November 2021, film director Quentin Tarantino released seven NFTs based on uncut scenes of Pulp Fiction. Miramax subsequently filed a lawsuit claiming that their film rights were violated and that the original 1993 contract with Tarantino gave them the right to mint NFTs in relation to Pulp Fiction. In August 2022, Muse released album Will of the People as 1,000 NFTs; it became the first album for which NFT sales would qualify for the UK and Australian charts. By February 2021, NFTs accounted for US$25 million of revenue generated through the sale of artwork and songs as NFTs. On February 28, 2021, electronic dance musician 3lau sold a collection of 33 NFTs for a total of US$11.7 million to commemorate the three-year anniversary of his Ultraviolet album. On March 3, 2021, an NFT was made to promote the Kings of Leon album When You See Yourself. Other musicians who have used NFTs include American rapper Lil Pump, Grimes, visual artist Shepard Fairey in collaboration with record producer Mike Dean, and rapper Eminem. A paper presented at the 40th International Conference on Information Systems in Munich in 2019 suggested using NFTs as tickets for different types of events. This would enable organizers of the respective events or artists performing there to receive royalties on the resale of each ticket.

The University of California, Berkeley announced in May 2021 its intention to auction NFTs of two patents of inventions for which the creators had received a Nobel Prize: the patents for CRISPR gene editing and cancer immunotherapy. The university would, however, retain ownership of the patents. 85% of funds gathered through the sale of the collection were to be used to finance research. The collection included handwritten notices and faxes by James Allison and was named The Fourth Pillar. It sold in June 2022 for 22 Ether, about US$54,000 at the time. George Church, a US geneticist, announced his intention to sell his DNA via NFTs and use the profits to finance research conducted by Nebula Genomics. In June 2022, 20 NFTs with his likeness were published instead of the originally planned NFTs of his DNA due to the market conditions at the time. Despite mixed reactions, the project is considered to be part of an effort to use the genetic data of 15,000 individuals to support genetic research. By using NFTs the project wants to ensure that the users submitting their genetic data are able to receive direct payment for their contributions. Several other companies have been involved in similar and often criticized efforts to use blockchain-based genetic data in order to guarantee users more control over their data and enable them to receive direct financial compensation whenever their data is being sold. Molecule Protocol, a project based in Switzerland, is trying to use NFTs to digitize the intellectual copyright of individual scientists and research teams to finance research. The project's whitepaper explains the aim is to represent the copyright of scientific papers as NFTs and enable their trade between researchers and investors on a future marketplace. The project was able to raise US$12 million in seed money in July 2022. A similar approach has been announced by RMDS Lab.

It has become well known that an NFT image can be copied or saved from a web browser by using a right click menu to download the referenced image. NFT supporters disparage this duplication of NFT artwork as a "right-clicker mentality". One collector quoted by Vice compared the value of a purchased NFT (in contrast to an unpurchased copy of the underlying asset) to that of a status symbol "to show off that they can afford to pay that much". The "right-clicker mentality" phrase spread virally after its introduction, particularly among those who were critical of the NFT marketplace and who appropriated the term to flaunt their ability to capture digital art backed by NFT with ease. This criticism was promoted by Australian programmer Geoffrey Huntley who created "The NFT Bay", modeled after The Pirate Bay. The NFT Bay advertised a torrent file purported to contain 19 terabytes of digital art NFT images. Huntley compared his work to an art project from Pauline Pantsdown and hoped the site would help educate users on what NFTs are and are not.

NFT purchases and sales have been enabled by the high energy usage, and consequent greenhouse gas emissions, associated with some kinds of blockchain transactions. Though all forms of Ethereum transactions have had an impact on the environment, the direct impact of these transaction has also depended on the size of the transaction. The proof-of-work protocol required to regulate and verify blockchain transactions on networks (including Ethereum until 2022) consumes a large amount of electricity. To estimate the carbon footprint of a given NFT transaction requires a variety of assumptions or estimations about the manner in which that transaction is set up on the blockchain, the economic behavior of blockchain miners (and the energy demands of their mining equipment), and the amount of renewable energy being used on these networks. There are also conceptual questions, such as whether the carbon footprint estimate for an NFT purchase should incorporate some portion of the ongoing energy demand of the underlying network, or just the marginal impact of that particular purchase. An analogy might be the carbon footprint associated with an additional passenger on a given airline flight.

In 2022, Ethereum cut its energy usage by 99.99 percent by switching to proof of stake. Other approaches to reducing electricity include the use of off-chain transactions as part of minting an NFT. Some NFT markets have offered the option of buying carbon offsets when making NFT purchases, although the environmental benefits of this have been questioned. In some instances, NFT artists have decided against selling some of their own work to limit carbon emission contributions.

In January 2022, the first instance of speech synthesis NFT plagiarism and fraud occurred when an NFT company called Voiceverse was discovered to have stolen content from 15.ai, a non-commercial text-to-speech project. Log files revealed that Voiceverse had generated voice lines of Twilight Sparkle and Rainbow Dash using 15.ai, pitched them up to sound unrecognizable, promoted them as the byproduct of their own technology, and sold them as NFTs without permission. When confronted, Voiceverse stated that someone on their marketing team had used the voice without proper attribution. The developer of 15.ai, who had previously stated their opposition to NFTs a month prior to the incident, responded with a tweet saying "Go fuck yourself," which went viral and gained widespread support. The anonymity associated with NFTs and the ease with which they can be forged make it difficult to pursue legal action against NFT plagiarists. In February 2023, artist Mason Rothschild was ordered to pay $133,000 in damages to Hermès by a New York court, after a jury sided with the copyright holder, for his 2021 digital depictions of the brand's Birkin handbag. Some NFT marketplaces responded to cases of plagiarism by creating "takedown teams" to respond to artist complaints. The NFT marketplace OpenSea has rules against plagiarism and deepfakes (non-consensual intimate imagery). Some artists criticized OpenSea's efforts, saying they are slow to respond to takedown requests and that artists are subject to support scams from users who claim to be representatives of the platform. Others argue that there is no market incentive for NFT marketplaces to crack down on plagiarism.

A process known as "sleepminting" allows a fraudster to mint an NFT in an artist's wallet and transfer it back to their own account without the artist becoming aware. This allowed a white hat hacker to mint a fraudulent NFT that had seemingly originated from the wallet of the artist Beeple. Plagiarism concerns led the art website DeviantArt to create an algorithm that compares user art posted on the DeviantArt website against art on popular NFT marketplaces. If the algorithm identifies art that is similar, it notifies and instructs the author how they can contact NFT marketplaces to request that they take down their plagiarized work. The BBC reported a case of insider trading when an employee of the NFT marketplace OpenSea bought specific NFTs before they were launched, with prior knowledge those NFTs would be promoted on the company's home page.

NFT trading is an unregulated market in which there is no legal recourse for such abuses. When Adobe announced they were adding NFT support to their graphics editor Photoshop, the company proposed creating an InterPlanetary File System database as an alternative means of establishing authenticity for digital works. The price paid for specific NFTs and the sales volume of a particular NFT author may be artificially inflated by wash trading, which is prevalent due to a lack of government regulation on NFTs.

Cardano is a public decentralized blockchain platform which uses the cryptocurrency, ADA, to facilitate transactions. Cardano's development began in 2015. When launched in 2017, it was the largest cryptocurrency to use a proof of stake blockchain. A number of independent entities collaborate on the project, including the Cardano Foundation based in Zug, Switzerland, and led by its chief executive officer Frederik Gregaard.

Cardano Foundation aims to standardize and promote the ecosystem (based in Switzerland). IOHK: an engineering company responsible for building the Cardano blockchain. Emurgo: responsible for commercial applications. Within the Cardano platform, the settlement layer keeps track of transactions. The second layer is the computation layer and is designed to be similar to Ethereum, enabling smart contracts and applications to run on the platform. Like other cryptocurrencies, Ada (ADA) can be stored on a digital wallet. Cardano's native digital wallet is named "Daedalus". The Daedalus wallet downloads a full copy of the entire transaction history of the Cardano blockchain. Wallet users face the risk of losing access to funds if the wallet's seed phrase is lost or stolen. Development phases of Cardano are named after notable figures in poetry and computer science: Byron, Shelley, Goguen, Basho, and Voltaire. The first three stages implemented a basic blockchain, and then implemented decentralisation and smart contracts. The Basho era focuses on scaling the blockchain. The Voltaire release adds a treasury model. Once part of Cardano's Voltaire phase, CIP-1694 was implemented through the Chang upgrade and subsequent Plomin hard fork in 2024 establishing "on-chain" governance. This transition enabled ADA token holders to create, vote on and implement proposals through a decentralized decision-making process, marking IOHK's successful transfer of network development control to the community. As with other proof-of-stake cryptocurrencies, Cardano offers "staking", which allows token holders to set-aside (delegate) tokens to potentially "validate" transactions on the same blockchain (Figure 1). The quantity of tokens staked corresponds with the likelihood of being chosen to validate a transaction, and thus be rewarded by the algorithm with more of the same token. Through various wallet implementations, users can participate in "staking pools" with other token holders. These staked tokens have a dual purpose, both securing the network through validation and enabling participation in the governance system.

In 2018, IOHK signed a memorandum of understanding with the government of Ethiopia to consider the use of Cardano in its coffee supply chain. The partnership with the Ethiopian government also investigate other ways to deploy Cardano in the country. In 2019, the Ministry of Education in the country of Georgia signed a memorandum of understanding with the Free University of Tbilisi to use Cardano and Atala, IOHK's decentralized identity software, to build a credential verification system for Georgia. In 2019, New Balance announced a pilot program on the Cardano blockchain so buyers could track the authenticity of OMN1S Kawhi Leonard basketball shoes. In April 2021, IOHK and the Ethiopia Ministry of Education announced plans for an identity and record-keeping system on Cardano and Atala for the country's five million school pupils.

In 2021, Hoskinson began working with electronic dance music DJ Paul Oakenfold to release an album, Zombie Lobster, on the Cardano blockchain. In 2021, IOHK and Dish Network announced a collaboration to investigate the use of distributed ledger technology. The Cardano blockchain was cited in Quartz as having the potential to help citizens in Zanzibar, Ethiopia, and Burundi get digital IDs. World Mobile Token (WMT), a project built on Cardano, offers remote mobile network access in Africa with approximately 150 nodes in East Africa (2022). Mark Cuban is cited as being skeptical about the project and Cardano adoption. In 2023, a Ghanaian startup named "Mazzuma" received funding from the Adaverse, a Cardano ecosystem accelerator. MassumaGPT aims to use AI in its contract creation platform.

2. System Architecture & Core Working Principles Cardano also enables creating non-fungible tokens (NFTs). Snoop Dogg released several thousand NFTs in a project named "Baked Nation" for the Cardano chain in April 2022. In 2023 a digital artist from the UK sold 7,200 individual works of humanoid deer for almost £500,000 on Cardano.

SHA-2 (Secure Hash Algorithm 2) is a set of cryptographic hash functions designed by the United States National Security Agency (NSA) and first published in 2001. They are built using the Merkle–Damgård construction, from a one-way compression function itself built using the Davies–Meyer structure from a specialized block cipher. SHA-2 includes significant changes from its predecessor, SHA-1. The SHA-2 family consists of six hash functions with digests (hash values) that are 224, 256, 384 or 512 bits: SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, SHA-512/256. SHA-256 and SHA-512 are hash functions whose digests are eight 32-bit and 64-bit words, respectively. They use different shift amounts and additive constants, but their structures are otherwise virtually identical, differing only in the number of rounds. SHA-224 and SHA-384 are truncated versions of SHA-256 and SHA-512 respectively, computed with different initial values. SHA-512/224 and SHA-512/256 are also truncated versions of SHA-512, but the initial values are generated using the method described in Federal Information Processing Standards (FIPS) PUB 180-4. SHA-2 was first published by the National Institute of Standards and Technology (NIST) as a U.S. federal standard. The SHA-2 family of algorithms are patented in the U.S. The United States has released the patent under a royalty-free license. As of 2026, the SHA-2 cryptographic hash function remains secure against known attacks, including those from quantum computers.

With the publication of FIPS PUB 180-2, NIST added three additional hash functions in the SHA family. The algorithms are collectively known as SHA-2, named after their digest lengths (in bits): SHA-256, SHA-384, and SHA-512. The algorithms were first published in 2001 in the draft FIPS PUB 180-2, at which time public review and comments were accepted. In August 2002, FIPS PUB 180-2 became the new Secure Hash Standard, replacing FIPS PUB 180-1, which was released in April 1995. The updated standard included the original SHA-1 algorithm, with updated technical notation consistent with that describing the inner workings of the SHA-2 family. In February 2004, a change notice was published for FIPS PUB 180-2, specifying an additional variant, SHA-224, defined to match the key length of two-key Triple DES. In October 2008, the standard was updated in FIPS PUB 180-3, including SHA-224 from the change notice, but otherwise making no fundamental changes to the standard. The primary motivation for updating the standard was relocating security information about the hash algorithms and recommendations for their use to Special Publications 800-107 and 800-57. Detailed test data and example message digests were also removed from the standard, and provided as separate documents. In January 2011, NIST published SP800-131A, which specified a move from the then-current minimum of 80-bit security (provided by SHA-1) allowable for federal government use until the end of 2013, to 112-bit security (provided by SHA-2) being both the minimum requirement (starting in 2014) and the recommended security level (starting from the publication date in 2011). In March 2012, the standard was updated in FIPS PUB 180-4, adding the hash functions SHA-512/224 and SHA-512/256, and describing a method for generating initial values for truncated versions of SHA-512. Additionally, a restriction on padding the input data prior to hash calculation was removed, allowing hash data to be calculated simultaneously with content generation, such as a real-time video or audio feed. Padding the final data block must still occur prior to hash output. In July 2012, NIST revised SP800-57, which provides guidance for cryptographic key management. The publication disallowed creation of digital signatures with a hash security lower than 112 bits after 2013. The previous revision from 2007 specified the cutoff to be the end of 2010. In August 2012, NIST revised SP800-107 in the same manner. In March 2023, NIST announced its decision to revise FIPS 180-4. FIPS 180-5 will remove the SHA-1 specification, add guidance from SP 800-107, and include editorial updates. The NIST hash function competition selected a new hash function, SHA-3, in 2012. The SHA-3 algorithm is not derived from SHA-2.

The SHA-2 hash function is implemented in some widely used security applications and protocols, including TLS and SSL, PGP, SSH, S/MIME, and IPsec. The inherent computational demand of SHA-2 algorithms has driven the proposal of more efficient solutions, such as those based on application-specific integrated circuits (ASICs) hardware accelerators. SHA-256 is used for authenticating Debian software packages and in the DKIM message signing standard; SHA-512 is part of a system to authenticate archival video from the International Criminal Tribunal of the Rwandan genocide. SHA-256 and SHA-512 are used in DNSSEC. Linux distributions usually use 512-bit SHA-2 for secure password hashing. Several cryptocurrencies, including Bitcoin, use SHA-256 for verifying transactions and calculating proof of work or proof of stake. The rise of ASIC SHA-2 accelerator chips has led to the use of scrypt-based proof-of-work schemes. In both 4G and 5G mobile networks, HMAC-SHA-256 is utilized as a key derivation function (KDF) to generate cryptographic keys essential for securing communications. This process is defined in the 3rd Generation Partnership Project (3GPP) Technical Specifications TS 33.401 and TS 33.501, which outline the security architecture and procedures for these networks. SHA-1, SHA-2, and SHA-3 are the Secure Hash Algorithms required by law for use in certain U.S. Government applications, including use within other cryptographic algorithms and protocols, for the protection of sensitive unclassified information. FIPS PUB 180-1 also encouraged adoption and use of SHA-1 by private and commercial organizations. SHA-1 is being retired for most government uses; the U.S. National Institute of Standards and Technology says, "NIST recommends that federal agencies transition away from SHA-1 for all applications as soon as possible. Federal agencies should use SHA-2 or SHA-3 as an alternative to SHA-1.". NIST's directive that U.S. government agencies ought to, but not explicitly must, stop uses of SHA-1 after 2010 was hoped to accelerate migration away from SHA-1. The SHA-2 functions were not quickly adopted initially, despite better security than SHA-1. Reasons might include lack of support for SHA-2 on systems running Windows XP SP2 or older and a lack of perceived urgency since SHA-1 collisions had not yet been found. The Google Chrome team announced a plan to make their web browser gradually stop honoring SHA-1-dependent TLS certificates over a period from late 2014 and early 2015. Similarly, Microsoft announced that Internet Explorer and Edge [Legacy] would stop honoring public SHA-1-signed TLS certificates from February 2017. Mozilla disabled SHA-1 in Firefox during early January 2016, but had to re-enable it temporarily via an update, after problems with web-based user interfaces of some router models and security appliances.

Implementations of all FIPS-approved security functions can be officially validated through the CMVP program, jointly run by the National Institute of Standards and Technology (NIST) and the Communications Security Establishment (CSE). For informal verification, a package to generate a high number of test vectors is made available for download on the NIST site; the resulting verification, however, does not replace the formal CMVP validation, which is required by law for certain applications.

As of December 2013, there are over 1300 validated implementations of SHA-256 and over 900 of SHA-512, with only 5 of them being capable of handling messages with a length in bits not a multiple of eight while supporting both variants. SHA224("") 0x d14a028c2a3a2bc9476102bb288234c415a2b01f828ea62ac5b3e42f SHA256("") 0x e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 SHA384("") 0x 38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b SHA512("") 0x cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877 eec2f63b931bd47417a81a538327af927da3e SHA512/224("") 0x 6ed0dd02806fa89e25de060c19d3ac86cabb87d6a0ddd05c333b84f4 SHA512/256("") 0x c672b8d1ef56ed28ab87c3622c5114069bdd3ad7b8f9737498d0c01ecef0967a Even a small change in the message will (with overwhelming probability) result in a different hash, due to the avalanche effect.

For example, adding a period to the end of the following sentence changes approximately half (111 out of 224) of the bits in the hash, equivalent to picking a new hash at random: SHA224("The quick brown fox jumps over the lazy dog") 0x 730e109bd7a8a32b1cb9d9a09aa2325d2430587ddbc0c38bad911525 SHA224("The quick brown fox jumps over the lazy dog.") 0x 619cba8e8e05826e9b8c519c0a5c68f4fb653e8a3d8aa04bb2c8cd4c Note 1: All variables are 32 bit unsigned integers and addition is calculated modulo 232 Note 2: For each round, there is one round constant k[i] and one entry in the message schedule array w[i], 0 ≤ i ≤ 63 Note 3: The compression function uses 8 working variables, a through h Note 4: Big-endian convention is used when expressing the constants in this pseudocode, and when parsing message block data from bytes to words, for example, the first word of the input message "abc" after padding is 0x61626380 Initialize hash values: (first 32 bits of the fractional parts of the square roots of the first 8 primes 2..19): h0 := 0x6a09e667 h1 := 0xbb67ae85 h2 := 0x3c6ef372 h3 := 0xa54ff53a h4 := 0x510e527f h5 := 0x9b05688c h6 := 0x1f83d9ab h7 := 0x5be0cd19 Initialize array of round constants: (first 32 bits of the fractional parts of the cube roots of the first 64 primes 2..311): k[0..63] := 0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da, 0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070, 0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2 Pre-processing (Padding): begin with the original message of length L bits append a single '1' bit append K '0' bits, where K is the minimum number >= 0 such that (L + 1 + K + 64) is a multiple of 512 append L as a 64-bit big-endian integer, making the total post-processed length a multiple of 512 bits such that the bits in the message are: Ioriginal message of length LI 1 IK zerosI IL as 64 bit integerI , (the number of bits will be a multiple of 512) Process the message in successive 512-bit chunks: break message into 512-bit chunks for each chunk create a 64-entry message schedule array w[0..63] of 32-bit words (The initial values in w[0..63] don't matter, so many implementations zero them here) copy chunk into first 16 words w[0..15] of the message schedule array Extend the first 16 words into the remaining 48 words w[16..63] of the message schedule array: for i from 16 to 63 s0 := (w[i-15] rightrotate 7) xor (w[i-15] rightrotate 18) xor (w[i-15] rightshift 3) s1 := (w[i-2] rightrotate 17) xor (w[i-2] rightrotate 19) xor (w[i-2] rightshift 10) w[i] := w[i-16] + s0 + w[i-7] + s1 Initialize working variables to current hash value: a := h0 b := h1 c := h2 d := h3 e := h4 f := h5 g := h6 h := h7 Compression function main loop: for i from 0 to 63 S1 := (e rightrotate 6) xor (e rightrotate 11) xor (e rightrotate 25) ch := (e and f) xor ((not e) and g) temp1 := h + S1 + ch + k[i] + w[i] S0 := (a rightrotate 2) xor (a rightrotate 13) xor (a rightrotate 22) maj := (a and b) xor (a and c) xor (b and c) temp2 := S0 + maj h := g g := f f := e e := d + temp1 d := c c := b b := a a := temp1 + temp2 3. Software Implementation, Frameworks & Protocols Add the compressed chunk to the current hash value: h0 := h0 + a h1 := h1 + b h2 := h2 + c h3 := h3 + d h4 := h4 + e h5 := h5 + f h6 := h6 + g h7 := h7 + h Produce the final hash value (big-endian): digest := hash := h0 append h1 append h2 append h3 append h4 append h5 append h6 append h7 The computation of the ch and maj values can be optimized the same way as described for SHA-1. SHA-224 is identical to SHA-256, except that: the initial hash values h0 through h7 are different, and the output is constructed by omitting h7. SHA-224 initial hash values (in big endian): (The second 32 bits of the fractional parts of the square roots of the 9th through 16th primes 23..53) h[0..7] := 0xc1059ed8, 0x367cd507, 0x3070dd17, 0xf70e5939, 0xffc00b31, 0x68581511, 0x64f98fa7, 0xbefa4fa4 the message is broken into 1024-bit chunks, the initial hash values and round constants are extended to 64 bits, there are 80 rounds instead of 64, the message schedule array w has 80 64-bit words instead of 64 32-bit words, to extend the message schedule array w, the loop is from 16 to 79 instead of from 16 to 63, the round constants are based on the first 80 primes 2..409, the word size used for calculations is 64 bits long, the appended length of the message (before pre-processing), in bits, is a 128-bit big-endian integer, and the shift and rotate amounts used are different. SHA-512 initial hash values (in big-endian): h[0..7] := 0x6a09e667f3bcc908, 0xbb67ae8584caa73b, 0x3c6ef372fe94f82b, 0xa54ff53a5f1d36f1, 0x510e527fade682d1, 0x9b05688c2b3e6c1f, 0x1f83d9abfb41bd6b, 0x5be0cd19137e2179 SHA-512 round constants: k[0..79] := 0x428a2f98d728ae22, 0x7137449123ef65cd, 0xb5c0fbcfec4d3b2f, 0xe9b5dba58189dbbc, 0x3956c25bf348b538, 0x59f111f1b605d019, 0x923f82a4af194f9b, 0xab1c5ed5da6d8118, 0xd807aa98a3030242, 0x12835b0145706fbe, 0x243185be4ee4b28c, 0x550c7dc3d5ffb4e2, 0x72be5d74f27b896f, 0x80deb1fe3b1696b1, 0x9bdc06a725c71235, 0xc19bf174cf692694, 0xe49b69c19ef14ad2, 0xefbe4786384f25e3, 0x0fc19dc68b8cd5b5, 0x240ca1cc77ac9c65, 0x2de92c6f592b0275, 0x4a7484aa6ea6e483, 0x5cb0a9dcbd41fbd4, 0x76f988da831153b5, 0x983e5152ee66dfab, 0xa831c66d2db43210, 0xb00327c898fb213f, 0xbf597fc7beef0ee4, 0xc6e00bf33da88fc2, 0xd5a79147930aa725, 0x06ca6351e003826f, 0x142929670a0e6e70, 0x27b70a8546d22ffc, 0x2e1b21385c26c926, 0x4d2c6dfc5ac42aed, 0x53380d139d95b3df, 0x650a73548baf63de, 0x766a0abb3c77b2a8, 0x81c2c92e47edaee6, 0x92722c851482353b, 0xa2bfe8a14cf10364, 0xa81a664bbc423001, 0xc24b8b70d0f89791, 0xc76c51a30654be30, 0xd192e819d6ef5218, 0xd69906245565a910, 0xf40e35855771202a, 0x106aa07032bbd1b8, 0x19a4c116b8d2d0c8, 0x1e376c085141ab53, 0x2748774cdf8eeb99, 0x34b0bcb5e19b48a8, 0x391c0cb3c5c95a63, 0x4ed8aa4ae3418acb, 0x5b9cca4f7763e373, 0x682e6ff3d6b2b8a3, 0x748f82ee5defb2fc, 0x78a5636f43172f60, 0x84c87814a1f0ab72, 0x8cc702081a6439ec, 0x90befffa23631e28, 0xa4506cebde82bde9, 0xbef9a3f7b2c67915, 0xc67178f2e372532b, 0xca273eceea26619c, 0xd186b8c721c0c207, 0xeada7dd6cde0eb1e, 0xf57d4f7fee6ed178, 0x06f067aa72176fba, 0x0a637dc5a2c898a6, 0x113f9804bef90dae, 0x1b710b35131c471b, 0x28db77f523047d84, 0x32caab7b40c72493, 0x3c9ebe0a15c9bebc, 0x431d67c49c100d4c, 0x4cc5d4becb3e42b6, 0x597f299cfc657e2a, 0x5fcb6fab3ad6faec, 0x6c44198c4a475817 SHA-512 Sum & Sigma: S0 := (a rightrotate 28) xor (a rightrotate 34) xor (a rightrotate 39) S1 := (e rightrotate 14) xor (e rightrotate 18) xor (e rightrotate 41) s0 := (w[i-15] rightrotate 1) xor (w[i-15] rightrotate 8) xor (w[i-15] rightshift 7) s1 := (w[i-2] rightrotate 19) xor (w[i-2] rightrotate 61) xor (w[i-2] rightshift 6) SHA-384 is identical to SHA-512, except that: the initial hash values h0 through h7 are different (taken from the 9th through 16th primes), and the output is constructed by omitting h6 and h7. SHA-384 initial hash values (in big-endian): h[0..7] := 0xcbbb9d5dc1059ed8, 0x629a292a367cd507, 0x9159015a3070dd17, 0x152fecd8f70e5939, 0x67332667ffc00b31, 0x8eb44a8768581511, 0xdb0c2e0d64f98fa7, 0x47b5481dbefa4fa4 SHA-512/t is identical to SHA-512 except that: the initial hash values h0 through h7 are given by the SHA-512/t IV generation function, the output is constructed by truncating the concatenation of h0 through h7 at t bits, t equal to 384 is not allowed, instead SHA-384 should be used as specified, and t values 224 and 256 are especially mentioned as approved. SHA-512/224 initial hash values (in big-endian): h[0..7] := 0x8c3d37c819544da2, 0x73e1996689dcd4d6, 0x1dfab7ae32ff9c82, 0x679dd514582f9fcf, 0x0f6d2b697bd44da8, 0x77e36f7304C48942, 0x3f9d85a86a1d36C8, 0x1112e6ad91d692a1 SHA-512/256 initial hash values (in big-endian): h[0..7] := 0x22312194fc2bf72c, 0x9f555fa3c84c64c2, 0x2393b86b6f53b151, 0x963877195940eabd, 0x96283ee2a88effe3, 0xbe5e1e2553863992, 0x2b0199fc2c85b8aa, 0x0eb72ddC81c52ca2 The SHA-512/t IV generation function evaluates a modified SHA-512 on the ASCII string "SHA-512/t", substituted with the decimal representation of t. The modified SHA-512 is the same as SHA-512 except its initial values h0 through h7 have each been XORed with the hexadecimal constant 0xa5a5a5a5a5a5a5a5. Sample C implementation for SHA-2 family of hash functions can be found in RFC 6234.

In the bitwise operations column, "Rot" stands for rotate no carry, and "Shr" stands for right logical shift. All of these algorithms employ modular addition in some fashion except for SHA-3. More detailed performance measurements on modern processor architectures are given in the table below. The performance numbers labeled 'x86' were running using 32-bit code on 64-bit processors, whereas the 'x86-64' numbers are native 64-bit code. While SHA-256 is designed for 32-bit calculations, it does benefit from code optimized for 64-bit processors on the x86 architecture. 32-bit implementations of SHA-512 are significantly slower than their 64-bit counterparts.

Variants of both algorithms with different output sizes will perform similarly, since the message expansion and compression functions are identical, and only the initial hash values and output sizes are different. The best implementations of MD5 and SHA-1 perform between 4.5 and 6 cycles per byte on modern processors. Testing was performed by the University of Illinois at Chicago on their hydra8 system running an Intel Xeon E3-1275 V2 at a clock speed of 3.5 GHz, and on their hydra9 system running an AMD A10-5800K APU at a clock speed of 3.8 GHz. The referenced cycles per byte speeds above are the median performance of an algorithm digesting a 4,096 byte message using the SUPERCOP cryptographic benchmarking software.

The MiB/s performance is extrapolated from the CPU clockspeed on a single core; real-world performance will vary due to a variety of factors. Like many other hashes, SHA-2 requires the use of HMAC function to generate a message authentication code (MAC). A naive construction S H A 2 ( k e y | | m e s s a g e ) {\displaystyle {\mathit {SHA2}}(key||message)} cannot be used as a MAC, as it is susceptible to few types of attacks, including the length extension attack.

Botan Bouncy Castle Cryptlib Crypto++ Libgcrypt Mbed TLS libsodium Nettle LibreSSL OpenSSL GnuTLS wolfSSL Hardware acceleration is provided by the following processor extensions: Intel SHA extensions: Available on some Intel and AMD x86 processors. VIA PadLock ARMv8 Cryptography Extensions IBM z/Architecture: Available since 2005 as part of the Message-Security-Assist Extensions 1 (SHA-256) and 2 (SHA-512) IBM Power ISA since v.2.07 Comparison of cryptographic hash functions Comparison of cryptography libraries Hash function security summary Hashcash HMAC International Association for Cryptologic Research (IACR) Trusted timestamping Non-fungible tokens (NFTs) drive the prosperity of the Web3 ecosystem. By November 2023, the total market value of NFT projects reached approximately 16 billion USD. Accompanying the success of NFTs are various security issues, i.e., attacks and scams are prevalent in the ecosystem. While NFTs have attracted significant attentions from both industry and academia, there is a lack of understanding of kinds of NFT security issues. The discovery, in-depth analysis, and systematic categorization of these security issues are of significant importance for the prosperous development of the NFT ecosystem.

To fill the gap, we performed a systematic literature review related to NFT security, and we have identified 142 incidents from 213 security reports and 18 academic papers until October 1st, 2023. Through manual analysis of the compiled security incidents, we have classified them into 12 major categories. Then we explored potential solutions and mitigation strategies. Drawing from these analyses, we established the first NFT security reference frame. Except, we extracted the characteristics of NFT security issues, i.e., the prevalence, severity, and intractability. We have indicated the gap between industry and academy for NFT security, and provide further research directions for the community. This paper, as the first SoK of NFT security, has systematically explored the security issues within the NFT ecosystem, shedding light on their root causes, real-world attacks, and potential ways to address them. Our findings will contribute to the future research of NFT security.

4. Practical Deployment, Analysis & Case Studies Since the beginning of 2021, non-fungible tokens (NFTs), a groundbreaking form of currency, have surged in popularity ( nft, 2021 ) . The most notable feature of NFT is its uniqueness . In other words, there is a cryptocurrency-based algorithm to guarantee that it is impossible to counterfeit an existing NFT. Taking advantage of this characteristic, as well as the anonymity and traceability of blockchain techniques, users can bind an NFT to a real-world asset, such as images, videos, or in-game items, through a URI (Uniform Resource Identifier) ( tok, 2023 ) . To this end, NFT has greatly reduced the transaction costs of goods, and many NFT projects have received considerable investment as a result. For example, one NFT project called BAYC ( BAY, 2022c ) has reached a total volume of over 1.4M Ether ( BAY, 2023 ) .

However, alongside their increasing popularity, the whole NFT ecosystem is under numerous security threats that have resulted in millions of dollars in losses for investors and project owners. For example, in April 2022, an individual lost his Bored Ape Yacht Club (BAYC) token worth over $3M in a fraudulent swap transaction ( Swa, 2022 ) . Similarly, in May 2022, a family was scammed out of $1.4M by a perpetrator who sold them a counterfeit Moonbirds token ( may, 2022 ) , which had taken them years to accumulate. In September 2022, hackers stole Ethereum valued at $185K from Bill Murray after he auctioned an NFT for charity ( sep, 2022 ) . According to a research report ( att, 2023 ) , there are currently more than 200 attack events against the NFT ecosystem, causing a total of more than $88M in economic losses. More importantly, the frequency of these attacks continues to increase year by year.

In recent years, some studies about NFT security have been conducted. For example, Das et al. ( Das et al., 2022 ) have conducted the first systematic analysis of NFT security. Stoger et al. ( Stöger et al., 2023 ) found that almost every interaction of a user with a centralized entity can be exploited to hijack NFTs or cryptocurrencies from the user. However, they only focus on the NFT market manipulation in the corresponding NFT projects, without paying attention on other components of the NFT ecosystem, like NFT smart contracts, which have also been exploited by adversaries to gain illegal profits.

To fill this gap, to the best of our knowledge, we have conducted the first SoK on the security side of the whole NFT ecosystem . Against the NFT ecosystem, our goal is to summarize all happened attack events, uncover all their root causes, and propose the corresponding best practices for developers and investors. This work. In this SoK, we first constructed an NFT security reference frame in § 3 . We collected the data from both security reports and academic papers and then extracted the incidents and security issues. Next, based on the reference frame, we dive deep into the contract layer in § 4 , the market layer in § 5 , the auxiliary service layer in § 6 , separately. Specifically, we further discuss the characteristics, current research, and potential detection/defense methods of the extracted security issues.

We give our key findings and provide the discussion as well as the potential future research direction in § 7.1 . To the best of our knowledge, we have conducted the first SoK on NFT security, encompassing both prominent and lesser-known security issues. Specifically, we have compiled the first NFT security reference frame, with 142 incidents belonging to 12 major categories, which will serve as a general model for NFT security.

We have extracted the characteristics of NFT security issues. We demystify these NFT security issues from characteristics including the prevalence, severity, and intractability. These characteristics serve as a compelling motivation to delve into the study of these security issues. We have pointed out the huge gap between industry and academia. Our result shows that current research on NFT security only addresses a limited portion of NFT security issues that have been discovered by the industry.

Blockchain implements a distributed ledger that utilizes cryptography to securely link growing lists of records, i.e. blocks ( blo, 2022b ) , together. Each block contains a set of transactions generated by accounts ( eth, 2022 ) , i.e., the participants in the blockchain network. Blocks are continuously added to the chain to form an immutable record of all past transactions, creating what is known as the mine of blocks ( min, 2023 ) . The chosen block is determined by consensus protocols ( con, 2019 ) such as PoW ( pow, 2023 ) or PoS ( pos, 2023 ) . Bitcoin ( Bit, 2023 ) is the first digital token that is implemented by blockchain technology. Ethereum first introduced the concept of smart contracts ( sma, 2023 ) in 2014, which are sets of codes that run on the blockchain. Transactions can be initiated between accounts or even contracts to achieve complex functionalities, such as transferring funds to another account or conducting calculations.

Smart contracts enable the creation of various digital tokens, extending beyond Bitcoin, which includes both fungible and non-fungible tokens (NFTs). Typically, these digital tokens are developed following specific protocols, such as the Ethereum Request for Comments (ERC) in the case of Ethereum. In Ethereum, fungible tokens are established under the ERC-20 standard, while NFTs are primarily implemented through ERC-721 and ERC-1155 standards.

Specifically, ERC-721 ( erc, 2023 ) is a standard protocol designed for NFTs where each token is bound to a single piece of digital content, e.g., art, music and video. ERC-721 tokens cannot be divided into smaller units and must be traded as whole entities. However, it has limitations, e.g., difficulties in representing repeated artwork, and bulk transfers of a large number of tokens at once. To address these, ERC-1155 ( ERC, 2022 ) was introduced, which allows multiple tokens to be associated with specific content, allowing all token holders to share access to that particular content. It also facilitates multi-token operations that enable the transfer of multiple tokens in a single transaction. Other standards, like Metaplex in Solona ( sol, 2023a ; sol, 2023b ) and BEP-721 in Binance ( bep, 2023 ; bin, 2023 ) , also support the nature of NFTs.

Taking advantage of the interactions among smart contracts, developers can achieve complex functionalities in a decentralized application (DApp) . DApps can operate on blockchain networks, ensuring data immutability, and guaranteeing the authenticity and reliability of information. Moreover, after porting traditional finance applications on decentralized blockchains, decentralized finance (DeFi) gradually emerges in 2017 ( def, 2023a ) . DeFi relies on smart contracts and decentralized networks to offer services like lending, borrowing, trading, and earning interest on cryptocurrencies. Specifically, decentralized exchange (DEX) is a special kind of DeFi DApp that implements cryptocurrency exchange.

To alleviate the burden of managing digital cryptocurrencies of users, wallets appear as browser plugins or standalone mobile applications ( wal, 2023 ) . It assists users in initiating cryptocurrency transactions, conducting identity verification, and interacting with smart contracts. A hot wallet is a type of wallet that remains consistently connected to the internet, offering rapid access and transaction capabilities. However, due to its online nature, it is more vulnerable to cyber threats than its offline counterpart, known as cold wallets. The private key is a randomly generated unique alphanumeric character, utilized to prove ownership and control over digital assets stored in the wallet.

Fig. 1 shows the overall landscape of the NFT ecosystem. Generally, it can be divided into four phases, i.e., asset creation , contract deployment , NFT minting and market circulation . Phase I: Asset Creation. The intrinsic value of an NFT primarily derives from its association with unique digital assets. To create an NFT project, the developer first creates a collection of digital assets, e.g., a set of images, and upload them to off-chain storage services, where users can access these digital assets via URIs (Unique Resource Identifiers). These developers would advertise their projects on public social media platforms (like Twitter ( twi, 2023a ) , Discord ( dis, 2023 ) , and Instagram ( ins, 2023 ) ) and also their official websites. Moreover, to consistently attract investors, they may also adopt some marketing strategies, like sharing project roadmaps or highlighting the artistic and economic potential of the project.

Phase II: Contract Deployment. The deployment of contracts is essentially the process of tokenizing digital assets, completing the mapping of off-chain assets to on-chain tokens. The developer deploys the smart contract under a specific non-fungible token standard, e.g., the ERC-721 standard on Ethereum, linking the URI on-chain to the digital asset on the storage service. 5. Performance Evaluation & Extended Technical Observations Phase III: NFT Minting. NFTs are created by a special event called Mint . Two methods are commonly used to create NFT tokens for investors. First, investors can pay the mint fees to the smart contracts, exchanging the right to mint the token.

Alternatively, the contract owner sometimes mints the tokens themselves and airdrops them to participants in the NFT ecosystem, freely distributing tokens and making them flow into the market. Each specific NFT is unique once minted by a smart contract, serving as the identification for that particular token and its associated content. Phase IV: Market Circulation. Participants in the NFT ecosystem typically perform trades of NFTs in secondary markets, i.e., the special decentralized applications focused on token trading, such as OpenSea ( ope, 2021 ) , LooksRare ( loo, 2022a ) , and X2Y2 ( x2y, 2021 ) . After creating NFTs, developers list their tokens for sale on secondary markets ( lis, 2022 ) .

Generally, these tokens are organized into collections ( nft, 2023 ) that refer to all tokens minted by the same smart contracts, which helps to gather all work in the same style, create a brand, and present it to the public. Secondary markets also provide an optional verification tag ( ver, 2023 ) to help increase the credibility of the collections. As decentralized applications, secondary markets have their smart contracts launched on the blockchain, such as Wyvern ( wyv, 2019 ) or Seaport ( sea, 2022 ) from OpenSea. These smart contracts implement different functions that help users trade in a secure environment.

Buyers can make offers or bids before purchasing assets. Once accepted, the smart contract on the blockchain transfers the asset to the target account. During the process, the trade fees ( nft, 2022a ) are withdrawn by the secondary market, and creator fees ( cre, 2022 ) are withdrawn by the creator group. We next present our methodology to construct a reference frame, which serves as the foundation for the analysis of security issues.

Security Incident. An NFT security incident refers to a concrete case that can or may result in an unexpected financial loss to one or multiple the following entities: (i) NFT holders, who own these tokens; (ii) NFT project teams, responsible for creating and managing NFT collections; and (iii) NFT sales platforms, which facilitate the trading and exchange of NFTs. Specifically, there are two types of incidents: (i) attacks that exploit the vulnerabilities within smart contracts, or the defects within market and auxiliary service, and (ii) accidents that do not explicitly involve proactive adversaries, but still causes the damage to relevant parties. For example, asset inaccessibility (see § 6.3 ) is labelled as accidents. This is because even if attackers or scammers do not intentionally take the corresponding actions, they can still result in significant harm to the affected individuals in the community.

Security Issue & Sub-issue. A security issue refers to an abstraction of a set of incidents that possess similar causes and processes. If necessary, an issue can be further divided into sub-issues. For example, the reentrancy security issue consists of two sub-issues, i.e., single-function and cross-function (see § 4.1.1 ). Similarly, each sub-issue is still composed of several incidents with similar root causes. Thus, security issue, sub-issue and incident form a multi-level inclusion relationship.

Category. Category refers to the abstract representation for the taxonomy and description of a group of related security issues. Layer. A layer is composed of components in the NFT ecosystem, and refers to an abstract location where a set of security issues occur.

Scope. To conduct a comprehensive analysis, we consider two types of materials as sources, i.e., academic papers and security reports . Specifically, academic papers generally conduct systematic research on security issues, which allows them to go beyond reported security incidents and propose more general detection methods. Even further, they sometimes suggest defense mechanisms. However, publishing academic papers often requires a significant amount of time for research, which means that academic papers on security issues tend to lag behind industry technical reports. Thus, we also collect security reports published by flagship blockchain security companies because of their timeliness and professionalism. The gathering process continued till October 1st, 2023.

Approach. Our data collection for academic papers and security reports is divided into four steps. First, we select a set of target sources. for security reports, we choose several reputable sources, i.e., Beosin ( beo, 2023 ) , SlowMist ( slo, 2023 ) , Blocksec ( blo, 2023a ) , Certik ( cer, 2023 ) , DeFiHackLabs ( def, 2023c ) , and De.Fi ( def, 2023b ) . For academic papers, we performed a thorough search on academic databases, i.e., Google Scholar, IEEE, ACM , with the keywords: non-fungible token, NFT, blockchain security, DeFi . Second, we collect all related materials from these sources. Then, we employ a rigorous review process. We engage two Ph.D. students with expertise in blockchain and security domains to meticulously review the collected materials. To ensure accuracy and eliminate potential biases, a paper is retained for our study only if both reviewers independently recognize its relevance to NFT security incidents or issues. In the final step, we recognized that relying solely on our initial search terms could lead to overlooking relevant papers. Thus, we take all identified security issues as keywords to perform a comprehensive search on these databases again, like specifically searching reentrancy .

Note that following the principle of selecting high-quality papers of previous SoK of blockchain ( Zhou et al., 2023 ) , we excluded papers published on arXiv from our data collection approach. We believe that since these papers do not undergo a peer-review process, some of them might be of lower quality, and excluding them could prevent fro introducing false positives into our dataset.

Dataset Overview. Consequently, we have identified 213 security reports and 18 academic papers. We noticed that certain incidents may be reported multiple times. After manually removing duplicates, 142 incidents from both security reports and academic papers are remained. The dataset is open-sourced at link . Building on the life cycle of NFTs depicted in § 2.3 and widely-adopted frames of blockchain security from existing work ( Zhou et al., 2023 ) , we define three distinct layers for the whole NFT ecosystem, i.e., contract layer , market layer , and auxiliary service layer . We classify all security issues according to the specific location where they occur. Specifically, the contract layer comprises all security issues in contracts, resulting from code weaknesses that attackers could exploit. Note that, we focus on not only Ethereum blockchain, but also other blockchain platforms that can mint NFTs, like Solana. The market layer is composed of security issues happened on NFT markets. This involves examining unusual and harmful trades, as well as malicious actions affecting the sellers and buyers, or even everyone involved in the market. The auxiliary service layer is defined as infrastructures that help in the regular workflow of NFT, such as social media or digital wallets. Therefore, we classify any security issues related to these infrastructures in this layer.

Table 1 presents all 16 security issues that we concern, as well as the category and layer they belong to. For each security issue, we further summarize the types of existing exploitation tactics. Moreover, we also conduct a comprehensive survey on current methods that can identify existing incidents and the best practices that can be adopted for each of security issue. Based on these material, we will discuss the answers to the following questions: How to identify existing security incidents targeting a specific security issue/sub-issue? In the lifecycle of a smart contract, it may invoke functions deployed by other accounts or even contracts. Since these functions are out of developers control, they may perform malicious operations, leading to unsafe external call.

Reentrancy allows attackers to make multiple calls and callbacks to gain additional profits, which goes against the original intent of the function. According to the number of involved functions during the attack, two types of reentrancy have been observed in the NFT ecosystem. Harvested Online Documentation & Reference Sources • https://en.wikipedia.org/wiki/Non-fungible%20token • https://en.wikipedia.org/wiki/Cardano%20%28blockchain%20platform%29 • https://en.wikipedia.org/wiki/SHA-2 • https://arxiv.org/html/2312.08000v1