1

I would like to ask a question a little bit similar to How exactly can someone prove they were the creator of an NFT?

In this scenario, the NFT is already minted. According to the description of the ERC721 standard, it does hold an URI (web or IPFS, not relevant for this example) that contains metadata of this NFT.

My question is, given this metadata, how one can prove it was written by the same party as the issuer of the NFT? I was trying to find some sort of signature field in the metadata format description written in the EIP-721 standard document but I could not get my answer.

My motivation is, I imagine an attack that is especially threatening if the URI is just a weblink (thus metadata content becomes mutable). A third party could inject fake metadata JSON object by a sort of man-in-the-middle attack. Without issuer signature, the receiver is not able to prove the metadata originates from the issuer of the NFT.

I think I must be missing something. Any clarification appreciated!

Improve this question

1 Answer 1

Reset to default
1

If the operation of the wallet is built correctly, then the contents of the minting transaction are signed by the account on the sender's side and in case of a MIM attack on the contents of a transaction, you will violate the correct signature of the sender's account and transaction will not be executed.

In order to protect the NFT metadata one must include its hash in the contract content that is being signed during minting. This could be done either by using content-addressed immutable storage for NFT metadata (such as IPFS) or by including the metadata hash explicitly in the contract. Alternatively, the hash of the object can be included in the URI that points to it - it will be 2 in 1

Improve this answer
11
  • I think I see what you mean. Content of the transaction is signed, but what about the content of metadata pointed by the URI?
    – Marek
    Nov 24, 2021 at 14:01
  • The content of the metadata specified in the URI can be converted to a hash, which is also written in NTF. This ensures the immutability of the data pointed by the URI.
    – Mad Jackal
    Nov 24, 2021 at 14:14
  • I agree for the case when metadata is stored using content addressed protocol such as IPFS. Then hash just has to be in the NFT contract. But to my impression most people use regular weblink and I don't see requirement to include metadata hash in the NFT contract for that case.
    – Marek
    Nov 24, 2021 at 14:39
  • Usually, a digital object (a picture, a movie, or the like) is packed in NFT, which has a file representation, regardless of whether a web link or an IPFS address points to it. And you can get a hash from any file. Another question is that the creators of NFT themselves are not concerned about this.
    – Mad Jackal
    Nov 24, 2021 at 19:27
  • 1
    Is it OK now? :-)
    – Mad Jackal
    Nov 25, 2021 at 14:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.