Unit
- Definition of NFTs: Non-fungible tokens are unique digital assets verified using blockchain technology, representing ownership of distinct items such as digital art, collectibles, or in-game items. Unlike cryptocurrencies, each NFT has a unique identifier that prevents one-to-one interchangeability.
- Blockchain as a trust layer: Public blockchains provide an immutable ledger recording the entire history of each token from creation to current ownership. This transparency eliminates the need for a central authority to validate authenticity or provenance.
- Smart contract role: NFTs are implemented as smart contracts on platforms like Ethereum. The contract defines token creation (minting), transfer rights, and metadata management. Rules encoded in the contract govern all interactions with the token.
- Token standards overview: ERC-721 is the original standard for a single unique token, while ERC-1155 allows both fungible and non-fungible tokens in one contract, offering efficiency for gaming and metaverse applications.
- Consensus mechanisms: Proof of Work (PoW) and Proof of Stake (PoS) secure the ledger. Ethereum's transition to PoS reduced energy consumption and enabled faster finality, impacting NFT transaction costs and throughput.
- Decentralized storage: NFT metadata (images, attributes) is stored off-chain on IPFS or Arweave to minimize on-chain costs and allow larger files. The on-chain token contains a URI pointing to the off-chain metadata.
- Minting process: Creating an NFT involves deploying a smart contract and calling a mint function that assigns a new token ID to a recipient address, storing the metadata URI and minting timestamp on-chain.
- Ownership and transfer: Ownership is tracked by the smart contract mapping token IDs to owner addresses. Transfers require a signed transaction from the current owner or an approved operator, adhering to the standard interface.
- Immutability and upgrades: Once deployed, smart contracts are immutable unless designed with proxy patterns. Developers must plan for upgrades using the transparent proxy pattern, which separates logic from data storage.
- Royalties and secondary sales: NFTs can embed royalty logic using standards like ERC-2981, which defines a royaltyInfo function returning the recipient and percentage for each sale. This ensures creators automatically receive a cut from secondary market transactions without relying on external platforms.
- Metadata integrity and verification: Off-chain metadata stored on IPFS uses content addressing; the URI includes the hash of the file, so any alteration breaks the link. Developers should pin metadata to ensure persistence, and some projects store critical attributes on-chain via base64 encoding for extra security.
- Marketplace integration and approval: Marketplaces interact with NFTs through the approve and setApprovalForAll functions, allowing them to transfer tokens on behalf of the owner. Users must verify the marketplace contract address before signing approvals to avoid granting control to malicious contracts that could drain assets.
Code Example
Solidity
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;
contract SimpleNFT {
mapping(uint256 => address) public owners;
mapping(uint256 => string) public tokenURIs;
uint256 public tokenCounter;
function mint(address to, string memory metadataURI) public {
tokenCounter++;
uint256 newTokenId = tokenCounter;
owners[newTokenId] = to;
tokenURIs[newTokenId] = metadataURI;
}
function transfer(address to, uint256 tokenId) public {
require(owners[tokenId] == msg.sender, 'Not owner');
owners[tokenId] = to;
}
}This minimal NFT contract stores ownership and metadata URI in mappings. The mint() function increments a counter and assigns ownership. The transfer() function requires caller to be the current owner. Production contracts implement the ERC-721 interface for compatibility.
Security Consideration
HIGH RISK
Vulnerability: Reentrancy in transfer functions
Mitigation: Always update state before calling external addresses. Use the checks-effects-interactions pattern or a reentrancy guard modifier to prevent recursive calls from draining the contract.
Reference: OWASP/SW-2
Quick Revision
- NFTs are unique blockchain-based tokens with distinct identifiers.
- Smart contracts on Ethereum define NFT behavior via standards like ERC-721.
- Metadata storage uses off-chain solutions like IPFS to reduce costs.
- Transfer functions must guard against reentrancy attacks.