Permission control vulnerabilities in Non-fungible token (NFT) contracts can result in significant financial losses, as attackers may exploit these weaknesses to gain unauthorized access or circumvent critical permission checks. In this paper, we propose NFTDELTA, a framework that leverages static analysis and multi-view learning to detect permission control vulnerabilities in NFT contracts. Specifically, we extract comprehensive function Control Flow Graph (CFG) information via two views: sequence features (representing execution paths) and graph features (capturing structural control flow). These two views are then integrated to create a unified code representation. We also define three specific categories of permission control vulnerabilities and employ a custom detector to identify defects through multi-view feature similarity analysis. Our evaluation of 795 popular NFT collections identified 241 confirmed permission control vulnerabilities, comprising 214 cases of Bypass Auth Reentrancy, 15 of Weak Auth Validation, and 12 of Loose Permission Management. Manual verification demonstrates the detector's high reliability, achieving an average precision of 97.92% and an F1-score of 81.09%. Furthermore, NFTDELTA demonstrates enhanced efficiency and scalability, proving its effectiveness in securing NFT ecosystems.

翻译：非同质化代币（NFT）合约中的权限控制漏洞可能导致重大经济损失，因为攻击者可能利用这些缺陷获取未授权访问或绕过关键权限检查。本文提出NFTDELTA框架，该框架结合静态分析与多视角学习技术检测NFT合约中的权限控制漏洞。具体而言，我们通过序列特征（表征执行路径）与图特征（捕捉结构控制流）两个视角提取全面的函数控制流图（Control Flow Graph, CFG）信息，并将这两个视角融合为统一的代码表示。同时，我们定义了三类特定的权限控制漏洞，并采用定制检测器通过多视角特征相似性分析识别缺陷。通过对795个热门NFT集合的评估，我们发现了241个已确认的权限控制漏洞，包括214例绕过授权重入漏洞、15例弱授权验证和12例松散权限管理。人工验证表明该检测器具有高可靠性，平均精确率达97.92%，F1分数达81.09%。此外，NFTDELTA展现出更优的效率和可扩展性，验证了其在保障NFT生态系统安全方面的有效性。