Sigvex
SolanamediumDetector2 min read

the Metaplex Token Metadata program Compliance

Detects the Metaplex Token Metadata program metadata standard compliance violations.

svmmediummetaplex-complianceaccess-controlstatic-analysisdetector

Metaplex Compliance

Overview

The canonical NFT-metadata compliance detector identifies programs that violate the canonical NFT metadata standard including missing owner checks before metadata operations, improper signer verification, unsafe account data access, and incorrect collection linking.

For remediation guidance, see Canonical NFT Program Compliance Remediation.

Why This Is an Issue

The canonical NFT metadata program is the leading standard for NFT metadata on Solana. Programs that do not follow its conventions produce NFTs that are not recognized by major marketplaces and wallets. Incorrect metadata operations can also create security vulnerabilities where unauthorized parties modify NFT metadata or collection status.

How to Resolve

Before (Vulnerable)

// Vulnerable: modifies metadata without owner verification
pub fn update_metadata(ctx: Context<UpdateMeta>, new_uri: String) -> Result<()> {
    let metadata = &mut ctx.accounts.metadata;
    metadata.uri = new_uri;  // No authority check
    Ok(())
}

After (Fixed)

// Fixed: validates update authority
pub fn update_metadata(ctx: Context<UpdateMeta>, new_uri: String) -> Result<()> {
    require!(
        ctx.accounts.authority.key() == ctx.accounts.metadata.update_authority,
        ErrorCode::Unauthorized
    );
    let metadata = &mut ctx.accounts.metadata;
    metadata.uri = new_uri;
    Ok(())
}

Example JSON Finding

{
  "detector": "metaplex-compliance",
  "severity": "medium",
  "confidence": 0.6,
  "message": "Metadata modification without update authority validation",
  "location": { "function": "update_metadata", "block": 0, "statement": 2 }
}

Detection Methodology

  1. Account data safety check: Identifies account data access without owner verification.
  2. Signer verification analysis: Checks for signer validation in creator operations.
  3. the Metaplex Token Metadata program pattern matching: Compares operations against the Metaplex Token Metadata program standard patterns.

Limitations

False positives: Custom metadata programs with non-Metaplex conventions may be flagged. False negatives: Programs that use the Metaplex Token Metadata program CPI but with subtle violations may pass.

References