如何错误地验证签名——AssociationNFT案例

Code Auditing

April 21, 2022

2 min read

The Association NFT 是一个由 NBA 推出的 NFT。然而，我们发现该 NFT 销售合约存在严重的漏洞，允许攻击者在不支付任何代币的情况下铸造大量 NFT。

该漏洞的根本原因是签名验证的错误使用。基本上，合约未能确保签名只能由用户（且仅由用户）使用一次。在这种情况下，攻击者可以重复使用特权用户的签名，并将代币铸造给自己。

我们可以看到，在 verify 函数中，签名中不包含发送者的地址。此外，没有机制来包含一个 nonce 以确保签名只能使用一次。这些安全要求是软件安全课程中的基本知识。

我们很惊讶如此普遍的 NFT 项目中会出现这样的漏洞。整个社区都需要更加关注合约的安全性。

关于 BlockSec

BlockSec 是一家开创性的区块链安全公司，由一群全球杰出的安全专家于 2021 年创立。公司致力于提升新兴 Web3 世界的安全性和可用性，以促进其大规模采用。为此，BlockSec 提供智能合约和 EVM 链安全审计服务、用于安全开发和主动阻止威胁的 Phalcon 平台、用于资金追踪和调查的 MetaSleuth 平台，以及供 Web3 构建者在加密世界中高效冲浪的 MetaSuites 扩展。

迄今为止，公司已为 MetaMask、Uniswap Foundation、Compound、Forta 和 PancakeSwap 等 300 多家尊贵客户提供服务，并从 Matrix Partners、Vitalbridge Capital 和 Fenbushi Capital 等杰出投资者那里获得了两轮数千万美元的融资。

官方网站：https://blocksec.com/

官方 Twitter 账号：https://twitter.com/BlockSecTeam

~$15.9M Lost: Trusted Volumes & More | BlockSec Weekly

May 14 2026Security Insights

~$15.9M Lost: Trusted Volumes & More | BlockSec Weekly

This BlockSec bi-weekly security report covers 11 notable attack incidents identified between April 27 and May 10, 2026, across Sui, Ethereum, BNB Chain, Base, Blast, and Berachain, with total estimated losses of approximately $15.9M. Three incidents are analyzed in detail: the highlighted $1.14M Aftermath Finance exploit on Sui, where a signed/unsigned semantic mismatch in the builder-fee validation allowed an attacker to inject a negative fee that was converted into positive collateral during settlement; the $5.87M Trusted Volumes RFQ authorization mismatch on Ethereum; and the $5.7M Wasabi Protocol infrastructure-to-contract-control compromise across multiple EVM chains.

Newsletter - April 2026

Apr 30 2026Security Insights

Newsletter - April 2026

In April 2026, the DeFi ecosystem experienced three major security incidents. KelpDAO lost ~$290M due to an insecure 1-of-1 DVN bridge configuration exploited via RPC infrastructure compromise, Drift Protocol suffered ~$285M from a multisig governance takeover leveraging Solana's durable nonce mechanism, and Rhea Finance incurred ~$18.4M following a business logic flaw in its margin-trading module that allowed circular swap path manipulatio

~$7.04M Lost: GiddyDefi, Volo Vault & More | BlockSec Weekly

Apr 29 2026Security Insights

~$7.04M Lost: GiddyDefi, Volo Vault & More | BlockSec Weekly

This BlockSec weekly security report covers eight attack incidents detected between April 20 and April 26, 2026, across Ethereum, Avalanche, Sui, Base, HyperLiquid, and MegaETH, with total estimated losses of approximately $7.04M. The highlighted incident is the $1.3M GiddyDefi exploit, where the attacker did not break any cryptography or use a flash loan but simply replayed an existing on-chain EIP-712 signature with the unsigned `aggregator` and `fromToken` fields swapped out for a malicious contract, demonstrating how partial signature coverage turns any historical signature into a generic permit. Other incidents include a $3.5M Volo Vault operator key compromise on Sui, a $1.5M Purrlend privileged-role takeover, a $413K SingularityFinance oracle misconfiguration, a $142.7K Scallop cross-pool index injection, a $72.35K Kipseli Router decimal mismatch, a $50.7K REVLoans (Juicebox) accounting pollution, and a $64K Custom Rebalancer arbitrary-call exploit.

Best Security Auditor for Web3

Validate design, code, and business logic before launch. Aligned with the highest industry security standards.

BlockSec Audit