NiftyApes security record
As of 3 Nov 2026, NiftyApes has 1 audit report on Trustblock, by Quantstamp, dated 20 Apr 2023. That report lists no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Audits1
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| NiftyApes - Seller Financing | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
Findings20
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 4 |
| Medium | 0 | 0 | 1 |
| Low | 1 | 8 | 6 |
HighFunds May Be Sent to Sanctioned AddressNiftyApes - Seller Financing · Quantstamp · 20 Apr 2023Fixed
`_makePayment()` currently allows payments to a sanctioned seller. If a buyer refuses (or is under legal obligation not) to send funds to the sanctioned seller, once enough time has passed, the sanctioned seller can transfer the ticket to a non-sanctioned address and seize the NFT. If a sanctioned seller does this near the end of the payment plan, then they will have effectively stolen all the funds from the buyer.
Open the reportHighLocked Funds when Fulfilling Seaport OrdersNiftyApes - Seller Financing · Quantstamp · 20 Apr 2023Fixed
Any offerings that are not WETH are locked forever after fulfilling a Seaport order. `_validateSaleOrder()` does not ensure that the length of `order.parameters.offer[]` is 1, meaning that there could be offers accepted that receive tokens outside of WETH. Since only WETH is transferred to the buyer, any additional funds would be locked in the contract without a method to withdraw them.
Open the reportHighSanctioned Users Can Transfer Their TicketsNiftyApes - Seller Financing · Quantstamp · 20 Apr 2023Fixed
Sanctioned users are allowed to transfer their buyer and seller tickets, as there is no check in `_transfer` to ensure the sending party is not sanctioned. A sanctioned user can easily transfer their ticket to a secondary address.
Open the reportHighUnderlying NFTs are Assigned Incorrect `nftId` for CollectionsNiftyApes - Seller Financing · Quantstamp · 20 Apr 2023Fixed
`_createLoan()` incorrectly assigns the `nftId` of both the `buyerUnderlyingNFT` and `sellerUnderlyingNFT` when financing collection offers. Collection offers have the `offer.nftId` value assigned as `~uint256(0)`, which is used to denote that the offer exists for the entire collection instead of an individual NFT. When buying from a collection offer, the buyer specifies the individual NFT they are purchasing in `nftId` field in `buyWithFinancing()`. However, the individual `nftId` is not assigned to the buyer and seller's underlying NFT, rather the `offer.nftId` is, which would be the maximum value for a `uint256`. This incorrect assignment would break the delegate.cash functionality if a buyer transfers their ticket, as delegate.cash would be attempting to delegate an NFT that does not exist.
Open the reportMediumUnable to Fulfill Seaport Bids with Multiple ConsiderationsNiftyApes - Seller Financing · Quantstamp · 20 Apr 2023Fixed
In `sellAsset()`, the total consideration is calculated as follows: ``` uint256 totalConsiderationAmount; for (uint256 i = 1; i < order.parameters.totalOriginalConsiderationItems; i++) { totalConsiderationAmount = order.parameters.consideration[i].endAmount; } ``` This is equivalent to setting the total consideration to the final element of `order.parameters.consideration[]` rather than the sum of the array. The contract will be unable to fulfill any Seaport orders that have multiple WETH considerations because it hasn't approved enough WETH to send to the Seaport contract.
Open the reportLowAnyone Can Call InitializeNiftyApes - Seller Financing · Quantstamp · 20 Apr 2023Fixed
`SellerFinancing` is intended to be the implementation contract for an upgradeable proxy, as it contains an `initialize()` function. Currently, anyone can call the `initialize()` method and write state variables to this contract. This could lead to an attacker taking control of the implementation contract.
Open the reportLowIncorrect Version of SolidityNiftyApes - Seller Financing · Quantstamp · 20 Apr 2023Fixed
The contracts currently use Solidity version 0.8.13. This version is not on the [list of recommended versions](https://github.com/crytic/slither/wiki/Detector-Documentation#incorrect-versions-of-solidity).
Open the reportLowMissing Call to Parent ContractNiftyApes - Seller Financing · Quantstamp · 20 Apr 2023Fixed
`__ERC721URIStorageUpgradeable_init()` is not called on construction. Although it does nothing in this version of the Open Zeppelin contracts, it is still a best practice to include this to support future upgradeability.
Open the reportLowPrivileged Roles and OwnershipNiftyApes - Seller Financing · Quantstamp · 20 Apr 2023Fixed
All privileged permissions should be clearly documented for users. The owner has the ability to arbitrarily set `royaltiesEngineContractAddress`. A custom version of this contract could redirect 100% of payments made to the owner. Additionally, these functions can all be invoked by the owner and modify core state addresses of `SellerFinancing`: - `updateRoyaltiesEngineContractAddress()` - `updateDelegateRegistryContractAddress()` - `updateSeaportContractAddress()` - `updateWethContractAddress()` - `pause()`, `unpause()` - `pauseSanctions()`, `unpauseSanctions()` As well as these functions in `MarketplaceIntegration`: - `updateSellerFinancingContractAddress()` - `updateMarketplaceFeeRecipient()` - `updateMarketplaceFeeBps()` - `pause()`, `unpause()` - `pauseSanctions()`, `unpauseSanctions()`
Open the reportLowSignatures Cannot Be Revoked when the Contract Is PausedNiftyApes - Seller Financing · Quantstamp · 20 Apr 2023Fixed
The `withdrawOfferSignature()` is restricted by the `whenNotPaused` modifier. Sellers should have the freedom to revoke their signatures at any time.
Open the reportShow 1 more
LowUsers Can Buy An NFT that They Cannot ReceiveNiftyApes - Seller Financing · Quantstamp · 20 Apr 2023Fixed
If a contract that has not correctly implemented the `onERC721Receive()` function acquires a buyer ticket, then they will not be able to receive the NFT at the end of their payment plan. Each time they go to make the final payment, the `makePayment()` function will revert when calling `_transferNft()`. At some point the loan will expire and the seller will be able to seize the NFT. Despite this, the buyer will be allowed to make payments and may not be aware of this issue until the end of their payment plan. This could happen in two scenarios: 1. The buyer ticket has been transferred to the contract without calling `safeTransferFrom()`. 2. A contract calls `buyWithFinancing()` from its constructor. This is possible because the `isContract()` in `safeMint()` will return `false` and the check will be skipped. A clever seller may trick a buyer into purchasing an NFT in this way as they stand to benefit greatly.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="niftyapes"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us