NFT Marketplace v6.1.3

Release Date: June 30, 2026 Tags: SECURITY, MONEY-SAFETY, RACE-SAFETY, IDOR, SECRETS

Overview

Version 6.1.3 is the NFT-marketplace half of the platform-wide Core v6.4.9 security audit. It makes auction settlement and purchases race-safe and chain-verified (so a retry or a race can't double-spend on-chain or flip ownership without payment), closes authorization holes on settlement and admin/blockchain endpoints, and removes a Pinata secret that was being shipped to the browser.

Requires Core v6.4.9.

---

Upgrade Notes

Compatibility

Requires Core v6.4.9 or higher. The uniqueness constraint on a sale's on-chain transaction and other schema changes are applied by the core migration commands (see the Core v6.4.9 patch notes); no NFT-only migration step is required.

Breaking Changes

None for normal use. Note that purchase/offer confirmation now fails closed when on-chain verification can't confirm funds reached the seller — an RPC outage defers settlement rather than completing it.

---

Fixed

Settlement and purchases are race-safe and verified

Auction settlement and fixed-price buys executed the on-chain call before any lock or claim, so two concurrent requests (or a retry) could both spend on-chain. The listing is now atomically claimed (ACTIVE → SOLD) before any irreversible call, with the claim reverted if the on-chain step fails. A sale's on-chain transaction can now be recorded only once, as a unique backstop; purchase verification requires the funds to reach the seller (not just the collection contract) with a currency-aware amount check, and the offer-confirm path no longer flips ownership and pays the marketplace fee when chain verification is unavailable or unverified.

Authorization (IDOR)

The auction settlement endpoint ran on-chain settle/transfer and ownership flips with no seller/owner/admin check; it now enforces that gate before any blockchain call. The public NFT token endpoint stops returning owner-only fields (unlockable content and owner wallet addresses) to anonymous callers, and an admin blockchain options endpoint that lacked a permission is now admin-gated.

Frontend secret removed

The IPFS module that shipped a Pinata secret to the browser via a NEXT_PUBLIC_* variable was removed. Rotate that key if it was ever deployed.