Getting started

The audit covers the core NFTX v4 protocol contracts at commit 6e4a1f6. It predominantly focusses on the Locker and Listings contracts, the Uniswap V4 hooks that sit in front of each collection pool, the CollectionShutdown flow and the zaps that route users into the protocol.

The core vault invariant held throughout the audit. We found no path that mints a collection token without depositing an NFT, nor one that removes an NFT from the Locker without burning one token-equivalent. We also found no gaps in access control across any of the contracts reviewed.

The issues that we have raised are all of medium severity or below. None of them put deposited NFTs or LP principal at risk of theft, but they do allow for fees to be diverted away from LPs, for buyers to overpay when using the zap and for core flows to be blocked at very little cost to the caller. Each of the medium severity issues has been reproduced in a Foundry test against the audited commit.

It has been assumed that the contract owner is trusted. Collection creators, listers, LPs, swappers and the NFT contracts themselves have all been treated as untrusted.

Thank you for auditing with Hooks.wtf.