Moxie Marlinspike Profile picture
Founder @signalapp

Oct 12, 2021, 5 tweets

I created an NFT, but the image renders differently based on who's looking at it.

For example, on OpenSea: opensea.io/assets/0x5c61a…

...vs on Rarible: rarible.com/token/0x5c61af…

...vs if you own it, it currently renders as a large 💩 emoji in your wallet. How this works:

1/n

NFT image data is not on-chain (too costly). Instead, what's on-chain is just a URL that *points* to the image. But surprisingly, there is no hash commitment in the NFT for the image at the URL. This means whoever controls the URL host can change the NFT image at any time.

2/n

Looking at popular NFTs, there are tokens trading for crazy $$ where the NFT image comes from a random VPS running Apache. The VPS admin, or anyone who controls the domain name, can change the NFT image/name to render as 💩 (or whatever) at any point w/o owning the token.

3/n

My NFT simply does this by default. It renders differently based on the IP/UA of the request, so the NFT image data isn't ever consistent, and what you bid on isn't what you get. This is how ERC721 is setup, though, not something unique to this NFT

Good luck to all bidders!

4/n

Update: my NFT was removed by OpenSea without warning or explanation. I don’t see any terms it violated?

No problem, this is web3 right? But the NFT also disappeared from my crypto wallet! Why? Because MetaMask just calls the OpenSea API. Loving the decentralized future so far..

Share this Scrolly Tale with your friends.

A Scrolly Tale is a new way to read Twitter threads with a more visually immersive experience.
Discover more beautiful Scrolly Tales like this.

Keep scrolling