引领:安全的智能合约开发

引领:安全的智能合约开发

在我们“安全智能合约开发”系列中,我们将深入探讨智能合约开发的关键安全方面,重点关注 NFT 合约。我们将探讨作为开发者可能遇到的各种风险和漏洞,并提供详细的策略和最佳实践来减轻这些问题,以提高区块链应用程序的安全性和效率。

深入解析:全面概述

本文探讨了 NFT 合约中的重入漏洞,详细介绍了单函数和跨函数重入。它解释了与这些漏洞相关的风险,并为开发人员提供了用于保护其智能合约的缓解策略。

数字签名已广泛用于智能合约中,例如在白名单铸币和订单簿 NFT 市场中。这是因为它有助于节省交易成本(链下签名和链上验证)。然而,开发人员的误用也给 NFT 市场带来了风险。在本文中,我们将讨论 NFT 生态系统中数字签名的误用。


关于 BlockSec

BlockSec 是一家开创性的区块链安全公司,由一群全球知名的安全专家于 2021 年创立。公司致力于提高新兴 Web3 世界的安全性和可用性,以促进其大规模采用。为此,BlockSec 提供智能合约和 EVM 链 安全审计 服务、用于安全开发和主动阻止威胁的 Phalcon 平台、用于资金追踪和调查的 MetaSleuth 平台以及供 Web3 构建者在加密世界中高效冲浪的 MetaSuites 扩展。

迄今为止,该公司已为 MetaMask、Uniswap Foundation、Compound、Forta 和 PancakeSwap 等 300 多家知名客户提供服务,并从 Matrix Partners、Vitalbridge Capital 和 Fenbushi Capital 等知名投资者那里获得了两轮融资,总计达数千万美元。

官方网站:https://blocksec.com/

官方 Twitter 账号:https://twitter.com/BlockSecTeam

Sign up for the latest updates
Weekly Web3 Security Incident Roundup | Feb 9 – Feb 15, 2026

Weekly Web3 Security Incident Roundup | Feb 9 – Feb 15, 2026

During the week of February 9 to February 15, 2026, three blockchain security incidents were reported with total losses of ~$657K. All incidents occurred on the BNB Smart Chain and involved flawed business logic in DeFi token contracts. The primary causes included an unchecked balance withdrawal from an intermediary contract that allowed donation-based inflation of a liquidity addition targeted by a sandwich attack, a post-swap deflationary clawback that returned sold tokens to the caller while draining pool reserves to create a repeatable price-manipulation primitive, and a token transfer override that burned tokens directly from a Uniswap V2 pair's balance and force-synced reserves within the same transaction to artificially inflate the token price.

Top 10 "Awesome" Security Incidents in 2025

Top 10 "Awesome" Security Incidents in 2025

To help the community learn from what happened, BlockSec selected ten incidents that stood out most this year. These cases were chosen not only for the scale of loss, but also for the distinct techniques involved, the unexpected twists in execution, and the new or underexplored attack surfaces they revealed.

#10 Panoptic Incident: XOR Linearity Breaks the Position Fingerprint Scheme

#10 Panoptic Incident: XOR Linearity Breaks the Position Fingerprint Scheme

On August 29, 2025, Panoptic disclosed a Cantina bounty finding and confirmed that, with support from Cantina and Seal911, it executed a rescue operation on August 25 to secure roughly $400K in funds. The issue stemmed from a flaw in Panoptic’s position fingerprint calculation algorithm, which could have enabled incorrect position identification and downstream fund risk.