NFT Metadata Security with Alex Atallah at NFT.NYC 2021

[FOREIGN] So I'm going to talk to you guys about NFT metadata and how to secure it, and we'll start at the very beginning for those of you who are new to this space. So metadata is basically the main thing that distinguishes an NFT from a number or a string that's just stored on chain. And going back to what builds or comprises an NFT, it's basically these 4 things. We have— I love this little laser pointer— we have property data, property rights, on-chain history, and the metadata. And property data basically means who owns what. The data that builds someone's property ownership on-chain is the owner of method, if you've heard of that, or the balance that a user has of a certain token. Fungible tokens have the same concept. Property rights are basically what you can do with an NFT, what owning it enables you to do, maybe accomplish a task in a game or filter what can be built on top of a land parcel in the metaverse. And then on-chain history is the trace of all the things that have happened to an NFT, whether it's been traded, locked, staked, or used in the game or used in some other dApp. So metadata, the fourth component, is basically what the content of an NFT is. So it comprises images, videos, animations. We have 3D models. We've seen GLB, GLTF, complex objects. Direct exports from programs like Sketchfab. We have names, descriptions, of course, properties, which is something that OpenSea's spent a lot of time refining over the years, information about who created the NFT, and links to things you can do or other resources. So external URLs, you can, from any NFT, you can link to maybe the primary marketplace for it or the the issuer's main site. So what's not known about metadata by a lot of developers is that we have a website, docs.opensea.io, that describes everything you can do, including all the different types of traits. For example, you can create a boost trait that— well, actually I'll skip, I'll show that in a few slides up ahead. You can create very rich traits that let you control and filter NFTs based on advanced properties that you set up for your users that only really matter for your game, that don't necessarily apply to all other NFTs on OpenSea. And if you go to this page, super, super useful, it'll explain how to set those up and how to actually implement your smart contract to return metadata so your users can see what your NFT is all about. So this is the slide that I thought was way further ahead than it is, but it's basically showing you a couple different types of traits that you can supply in your metadata. There's properties. These are just strings, words, phrases that you can associate with every NFT. So for example, let's say you have a game involving jellyfish. You can give it a property called jellyfish. That tells users what the base of the NFT is. And maybe you've got another property called Joy because it's smiling. So OpenSea will automatically compute the rarity of each of these traits. And this is a really critical thing for your buyers and your collectors to understand. It really helps them value NFTs and it's something you really cannot overlook if you're creating a collection of your own. Another important trait that not a lot of people know about is levels. This is a specific type of numerical trait that gives you a progress bar UI and lets users see like what a number is out of. And OpenSea will automatically help you compute the maximum value of a, a level like stamina based on all the NFTs in your collection. Or you can tell OpenSea what the maximum is. It's up to you. Another thing that very few people know about metadata is that it can apply to an entire smart contract, not just individual NFTs that you create. The smart contract is the program that controls who owns what. All those 4 things that we covered in the first slide. And the smart contract shows up on OpenSea as a collection. Collections you can configure directly on OpenSea in the UI. You can change their name, description, and everything about them. Or you can actually put that information in your smart contract and you don't even have to touch OpenSea if you don't want to. You can configure a name, image, you can configure the royalty that goes to you every time an item sells on the secondary market and which wallet address you'd like royalties to be sent to. Super, super important slide. Many of you, like, raise your hand in the audience if you're a developer and keep your hand raised if you've deployed metadata or built a smart contract. Alright, so a really useful tool that you can use OpenSea for is validating metadata. And OpenSea will take your API that comes out of your smart contract, do a comparison with all the different types of NFT metadata that we've seen since January 2018, and figure out what you might be doing wrong. Or ways you could improve your metadata to make it a little better. We have two different types of— oops— two different types of metadata validation endpoints. One for all the testnet blockchains. It's like Rinkeby, if you've heard of that, is an example. And all the mainnet blockchains, which includes Polygon, Clayton, and Ethereum. And you can use the validate endpoint, which is basically just putting this word validate at the end of the URL. And you'll see all the errors in your metadata. So if you're seeing items not show up on OpenSea the way you thought they would, then you just have to do two things. One, work on testnets so that you can play before you deploy. And two, use the validate endpoint to figure out what's going on. And, and then you can contact our support if it's still not making any sense. [FOREIGN LANGUAGE] A new thing in metadata that we've seen over the last 12 months that I think is really exciting is increasing desire to decentralize it. So let's talk about what that means. You can kind of break down metadata into these 4 quadrants. There's fully centralized metadata, which means it's hosted on someone's cloud provider by some company, And that company can change it, take it down whenever they want. There's also centralized and verifiable metadata, which is slightly different. So, raise your hand in the audience if you've seen the CryptoPunks metadata file. All right. There's a few. Now, the CryptoPunks metadata file is kind of interesting. It is a giant image of text. 10,000, it's a sprite of 10,000 squares. And each CryptoPunk is a particular XY coordinate on that sprite. That image though is not stored on-chain. That would be very expensive to do. Ethereum's not meant for storing large files. But what you can store on-chain cheaply is the hash of an image. So the hash of that giant sprite is stored directly in the smart contract for CryptoPunks. And that's what we mean by centralized and verifiable. We can check to see if someone has tampered an image in CryptoPunks by just looking at the hash of all 10,000 of them. The other column here is decentralized. So we have fully— we have decentralized metadata that includes when a contract has IPFS URLs or Arweave URLs set. For the images on the collection. IPFS and Arweave are types of decentralized file storage networks, meaning no single node is responsible for storing the image. And it doesn't quite get you full— it doesn't quite get your users the full guarantee that they're— that in 100 years the image will still be up no matter what happens to every company in the space. So for very, very high-value art, we frequently hear from artists that they really want a guarantee, that their buyers really want a guarantee that no company is going to be in charge of holding or taking— will be ever able to take down the art that backs the NFT. Otherwise, why would, why would someone pay six figures for it? So an important thing to do with decentralized metadata is to also make it immutable. This means that no one will ever be able to change the metadata, not the contract creator and not the service that's actually hosting the image. So going back up a level, the big problems with centralizing metadata is that first the server can go down or offline, and then it becomes really hard to find the image. You have to go to caching sites, including OpenSea, to look up what it was at a certain point in time. And the second big disadvantage is mutability, that you don't want to allow the developer creator to change the image later if that's not what you bought as a collector. So OpenSea, as of a few months ago, added a new row to every item page called metadata, and we will explain what's going on with the metadata for every NFT. If you see Frozen, then you can click on this. It's a link and will send you to the metadata that backs the NFT. And if it's frozen and not changeable by the developer, will indicate that. So you can have some guarantee as a buyer that the metadata is safe. So we're seeing a couple of cool things happen with metadata, and I think there's a lot of room for it to grow. It's one of the most underexplored areas for NFT innovation. And, you know, a lot of people look at them and the metadata standard or our docs as the source of truth for everything that's possible for what you can do with off-chain data and NFTs. And that's absolutely not true. If you work on complex and interesting projects, we'll work with you to make sure they show up correctly and to give your buyers and collectors what they deserve. So keep a very, very open mind when you're developing your own NFT project and contact us when you have new ideas. So there are a couple new concepts that you can go down if you want to explore new types of metadata. There are new kinds of 3D models that no one has tried, you know, including a lot of different things you can do in Sketchfab that would really expand the playing field for metadata. NFT hyperlinks. I'm still surprised that to this day we've barely seen any projects at all that link to other NFTs in their metadata. Like CryptoKitties actually did this. Every NFT, every CryptoKitty had a link to its parents. The parents that birthed the kitty that you're looking at. But since then, we haven't really seen much NFT hyperlinking. There's also the ability to have NFTs on multiple blockchains now and to explain using metadata how to traverse these chains to get to new types, to get to new NFTs that matter to the buyer. There's rich— there's unlockable content. Which if you've ever used it on OpenSea is pretty simple right now. It's just some text and you're not allowed to see it unless you own the NFT. There's a lot of new things that you could do here that would enable new applications like ticketing and unlocking digital or physical experiences for your buyers. Lastly, there's licenses. Imagine being able to buy a font license as an NFT. It, it's important to keep it scarce. You know, if you see a font on every website, it becomes not really that interesting anymore. You don't— like, no one uses Comic Sans. There's— it's important to keep it transparent. Imagine creating a font and not being able to know if some website actually bought the license for you. And third, it's important to reward the actual artist. Raise your hand in the audience if you've ever bought a font online somewhere a license for a font? And keep your hand raised if you know who the calligrapher was. That's 0%. And like, you could give calligraphers a royalty if fonts were NFTs, and imagine what that would do to the font industry. Last point I want to bring up in this talk is securing metadata. This is extremely important to do. And it's something we're seeing with incredible urgency right now, because when any space and technology blows up, there are bad actors that will follow every successful project. So keeping your metadata secure, and if you're building a platform for NFTs, being alerted to the different types of malicious metadata that could pop up is, it's really, really key. And we'd like to help companies in the space do this. So we've seen over the last 2 and a half months an enormous number of malicious NFTs and NFTs with metadata that shows something that buyers aren't expecting. And we've patched these issues and we've, we haven't seen any attacks that affected users with metadata directly on OpenSea, but we have seen NFTs that could do this to other platforms unless they make the same patches. We've seen a lot of cross-site scripting attacks. What that means is that the image of the NFT, even though it looks like an image or makes the browser think it's an image, is actually running a script. We've seen malicious external URLs that send users to malicious websites that either phish some other platform like OpenSea, or trigger a download onto your computer. We've seen complex text fields with, uh, like emojis that look like the checkmark to make people think that the item is verified. We've seen malicious unlockable content, and, um, whenever we see this, we have some processes in place that automatically flag them for us to investigate and fix, and we've worked with a lot of security research to help track these down proactively before anyone creates them. But what we'd like to do is start sharing the knowledge that we've accumulated about malicious NFT metadata with other companies in the space and create a private group, an NFT security group where companies can share the vulnerabilities they're discovering before they hit mainstream and before they hit other platforms. That way it will save a lot of companies on, on bounties, but it will also allow companies to proactively protect users before NFTs show up on those platforms. We're doing this so that we can accelerate these fixes and get specs out early, like when they're either reported to OpenSea or to other companies in the space, and also to increase the protection surface area for our users and for other platforms' users. Web3 security is very different from Web2 security. There's no single company that can secure everybody. Because it's so easy for users to go and view their inventory on other platforms, all of those platforms have to secure themselves. So we think for these reasons we'd like to set this up. Um, we've sent out invites to a couple companies so far and we'll keep adding more as, uh, as we continue to refine the model for how we report and track these vulnerabilities. And you can follow along here on our blog for more updates. That's all. [APPLAUSE]