Understanding Security Issues in the NFT Ecosystem

Non-Fungible Tokens (NFTs) have emerged as away to collect digital art aswell as an investment vehicle.Despite having beenpopularized only recently, NFTmarkets have witnessed several high-profile (and high-value) asset sales and a tremendous growth in trading volumes over the last year. Unfortunately, these marketplaces have not yet received much security scrutiny. Instead, most academic research has focusedonattacks against decentralizedfinance (DeFi) protocols and automated techniques to detect smart contract vulnerabilities. To the best of our knowledge, we are the first to study themarket dynamics and security issues of the multi-billion dollar NFT ecosystem. In this paper, we first present a systematic overview of how the NFT ecosystemworks, and we identify three major actors: marketplaces, external entities, and users. We then perform an in-depth analysis of the top 8marketplaces (ranked by transaction volume) to discover potential issues, many of which can lead to substantial financial losses. We also collected a large amount of asset and event data pertaining to the NFTs being traded in the examined marketplaces. We automatically analyze this data to understand how the entities external to the blockchain are able to interfere with NFT markets, leading to serious consequences, andquantify themalicious trading behaviors carried out by users under the cloak of anonymity.