Imaging you have an ERC721 contract with an infinite max supply. Usually, the metadata IPFS url will be the base url concatenated with the token ID: ipfs://[base-url]/[token-id]. Say we are up to token ID 4000, and someone decided to create malicious metadata at IPFS location ipfs://[base-url]/4001, and then mint a new token, what is stopping this from happening? Is there any way to write protect the base url? If not, is it only possible to solve this problem by making the next token ID unpredictable? Thanks in advance.
If you are publishing to a URL that starts with
- Anybody can inspect all the files in all paths starting at ABC.
- Nobody can change the contents of the paths starting at ABC.
This is a major design of the system. In fact, the choice of the letters ABC is based on the contents of all the files in all paths underneath it.
Applying to your question that means by the time ipfs://[base-url]/4000 is published, ipfs://[base-url]/4001 is already known and unchangeable.