Instead of storing the data on-chain, NFTs instead contain a URL that points to the data. What surprised me about the standards was that there’s no hash commitment for the data located at the URL. Looking at many of the NFTs on popular marketplaces being sold for tens, hundreds, or millions of dollars, that URL often just points to some VPS running Apache somewhere. Anyone with access to that machine, anyone who buys that domain name in the future, or anyone who compromises that machine can change the image, title, description, etc for the NFT to whatever they’d like at any time (regardless of whether or not they “own” the token). There’s nothing in the NFT spec that tells you what the image “should” be, or even allows you to confirm whether something is the “correct” image.
So as an experiment, I made an NFT that changes based on who is looking at it, since the web server that serves the image can choose to serve different images based on the IP or User Agent of the requester. For example, it looked one way on OpenSea, another way on Rarible, but when you buy it and view it from your crypto wallet, it will always display as a large 💩 emoji. What you bid on isn’t what you get. There’s nothing unusual about this NFT, it’s how the NFT specifications are built. Many of the highest priced NFTs could turn into 💩 emoji at any time; I just made it explicit.
After a few days, without warning or explanation, the NFT I made was removed from OpenSea (an NFT marketplace):
Moxie Marlinspike
I saw this pointed out elsewhere as well – that a NFT is merely a link to a file, and while the link may be ‘crypto-secured’, the file itself may change at any point in the future and you’d be left holding something else than you originally ‘bought’ – but I think it serves to underline that the whole premise of NFTs is a massive scam. In the flurry of reporting about this latest craze, it’s easy to lose perspective – keep in mind that more people own items in Second Life than own NFTs. The article also explores the poor privacy of the protocols and the increasing centralization around a couple of companies that others use to interact with the blockchain – and recent news about a database outage at OpenSea confirm this covert centralization. This whole system feels like a ticking bomb of speculation and absurdity waiting to burst.