Sigvex
SolanamediumDetector2 min read

NFT Royalty Bypass

Detects NFT royalty enforcement bypass patterns.

svmmediumnft-royalty-bypassfund-safetystatic-analysisdetector

NFT Royalty Bypass

Overview

The NFT royalty bypass detector identifies patterns that bypass NFT royalty enforcement, allowing transfers without paying required royalties to creators. It detects NFT transfers without royalty validation, missing the Metaplex Token Metadata program royalty enforcement checks, direct token transfers bypassing marketplace royalties, and custom transfer logic that skips royalty payments.

For remediation guidance, see NFT Royalty Bypass Remediation.

Why This Is an Issue

Creator royalties fund ongoing development and reward original artists. Programs that transfer NFTs without enforcing royalty payments undermine the NFT ecosystem and harm creators financially. the canonical NFT program’s Programmable NFTs (pNFTs) were introduced specifically to enforce royalties, but programs that bypass the Token Metadata program can circumvent these protections.

How to Resolve

Before (Vulnerable)

// Vulnerable: direct token transfer bypassing royalties
pub fn transfer_nft(ctx: Context<TransferNft>) -> Result<()> {
    token::transfer(ctx.accounts.into_transfer_ctx(), 1)?;
    // No royalty payment
    Ok(())
}

After (Fixed)

// Fixed: use the Metaplex Token Metadata program transfer with royalty enforcement
pub fn transfer_nft(ctx: Context<TransferNft>) -> Result<()> {
    invoke(
        &mpl_token_metadata::instruction::transfer(
            TransferArgs::V1 {
                amount: 1,
                authorization_data: None,
            },
            // ... accounts including metadata, edition, token_record
        ),
        accounts,
    )?;
    Ok(())
}

Example JSON Finding

{
  "detector": "nft-royalty-bypass",
  "severity": "medium",
  "confidence": 0.6,
  "message": "NFT token transfer without royalty enforcement check",
  "location": { "function": "transfer_nft", "block": 0, "statement": 1 }
}

Detection Methodology

  1. NFT transfer detection: Identifies token transfers of amount 1 (NFT transfers).
  2. Royalty payment search: Checks for corresponding lamport/token transfers to creator addresses.
  3. Metadata read analysis: Verifies whether metadata with royalty information is read before transfer.
  4. the Metaplex Token Metadata program CPI detection: Checks for the canonical NFT metadata program CPI for compliant transfers.

Limitations

False positives: Programs that enforce royalties through a separate settlement mechanism. False negatives: Complex royalty splitting across multiple transactions.

References