VegaSec NFT audit reference
A reference NFT audit on a fictional internal Vega collection. Shows the contract, collection metadata and operator-review risks VegaSec surfaces when a team submits an ERC-721 or ERC-1155 contract for triage.
- Fictional internal collection. Not deployed, not for sale, no real artist or brand implied.
- Findings are static + read-only RPC output. No human operator review has been attached.
- Severity, confidence and exploitability follow the same conservative posture as the Solidity audit.
- The report is read-only. It does not require a wallet, signature, or account.
NFT scan report
4 findings
ERC-721 · ETHEREUM · 0x000000000000000000000000000000000000fic7
Executive summary
- 4 findings on the fictional reference collection (1 high, 2 medium, 1 low).
- HIGH · Owner can rotate the base URI after sale — exploitability medium (requires trust assumption).
- Automated static + read-only RPC probes. A human operator review has not been attached to this report.
- highMetadata mutabilityConfidence: highExploitability: medium
Base URI can be rotated after sale
VegaReferenceCollection.setBaseURI · nft:mutable-base-uri
The reference contract exposes a `setBaseURI` function gated only by Ownable. The owner can rewrite the URI prefix after mint closes, which means every token's pointer to art and traits can change without holder consent.
Verified contract
Slither detector matched `setBaseURI` is callable by the contract owner with no time lock or pause flag.
Metadata URI
Current tokenURI points at ipfs://bafyfictional/1.json; the prefix is mutable so the same token id can later resolve to a different artifact.
Remediation hint
Freeze the base URI once the mint window closes, or move the setter behind a time-locked multisig the operator does not control unilaterally.
- mediumMint / supplyConfidence: highExploitability: medium
Owner-only mint has no maximum supply cap
VegaReferenceCollection.mintTo · nft:owner-mint-uncapped
`mintTo` is callable by the contract owner and increments token id without checking against a configured cap. The total supply can therefore grow indefinitely after public sale ends, which dilutes existing holders.
Verified contract
Static analysis flagged `mintTo` lacks a `require(totalSupply() + amount <= MAX_SUPPLY)` guard.
Remediation hint
Introduce a constant MAX_SUPPLY and revert when mintTo would exceed it. Document the cap in the deployment runbook.
- mediumUpgradeabilityConfidence: mediumExploitability: medium
Upgradeable proxy with owner-controlled admin
VegaReferenceCollection.ProxyAdmin · nft:upgradeable-proxy
The collection sits behind a UUPS proxy whose ProxyAdmin is the same EOA that owns the implementation. A single key compromise can replace the implementation logic for every token.
RPC state
ProxyAdmin slot resolves to the same address as `owner()`; no timelock contract sits between them.
Remediation hint
Move ProxyAdmin to a time-locked multisig. Publish the upgrade procedure and warning window in the deployment runbook.
- lowRoyalty misuseConfidence: highExploitability: low
Royalty receiver is the contract owner
VegaReferenceCollection.royaltyInfo · nft:royalty-receiver-owner
EIP-2981 reports the contract owner as the royalty receiver. This is not by itself an exploit, but secondary marketplace royalties accrue to whoever currently holds the owner role rather than to a fixed creator address or a fee-split contract.
RPC state
`royaltyInfo(tokenId, 10000)` returns the current `owner()` as the receiver with a 7.5% rate.
Remediation hint
Point royalties at an immutable fee-split contract or a documented multisig instead of a rotatable owner role.
Limitations
- VegaSec runs static + read-only analysis only. No human auditor has signed off on this report.
- The contract on this page is a fictional internal VegaSec fixture, not a deployed collection and not an investment.
- Off-chain metadata mutability is checked only at the time of acquisition; an asset can flip after the report is generated.
- This report is not a certification, audit attestation, or financial advice.
Report badges
Badges describe the evidence carried by this report artifact, not financial value or future pricing. Operator-reviewed is never granted automatically.
What this reference is, and is not
- This is a public reference artifact, not a certification or audit attestation.
- The collection on this page is a fictional VegaSec internal fixture, not a product and not an investment.
- VegaSec runs static + read-only analysis only. Real audits also need human review.
- No real brand, project, artist or asset is implied by the fixture or by this report surface.