You don't know NFTs (really!)

Transcript

hello cool okay so hello everybody my name is kevin i'm working as a software engineer at ledger i've been there for a little bit more than a year now and for eight to nine months of that year i've been actually mostly focused on adding nfts inside legionlive which is our solution for as a companion app for the nano that we're selling and my goal of today is to explain a little bit more what actually is an nft and i know for a lot of people that's that might already be clear but i'm not sure that technically speaking everybody understand what you can do with an nft or not or with a smart contract actually

so if you ask that question to a lot of different person you will get a wide range of answers and if you take for example someone that has absolutely no knowledge whatsoever about the blockchain they will tell you something kind of my mom uh like it's a picture of bitcoin of course that's completely wrong but at least it's a little bit funny why is it funny it's just funny because she's never going to own anything she's never going to own any crypto assets so knowing what it is it's not that important i guess if you take someone who heard about it just in the media or something like this they don't really use it but they heard about it somewhere

for them most of the time it's going to be it's an image on the blockchain so that's what they believe it is they believe it's just some kind of image that is stored inside the block and that you can find very easily and spoiler for those of you for those that actually know that it's not an image on the blockchain they will tell you most probably that it's a proof of ownership and that's the most common thing that you will hear that you will hear so they believe there is some kind of jpeg police that is capable of saying that you're owning something and you don't but let's try to see really what is behind the the two

assumptions that we have here is it actually an image on the blockchain probably we already spoiled it a little bit so we know that it's not but let's get it a bit more technical well first of all an nft is never just an image it's a json file stored somewhere that will contain all the description of your nfc so you will have the image the name the description properties etc so first of all you're not owning a jpeg if you're owning anything then almost no nftr no metadata is actually stored on the blockchain that would be that would cost too much and nobody's actually doing it that way so now you have basically two options

you need to store that json somewhere you have the first option that is probably that has been actually the most common thing to do is storing it on a web 2 server very simple you can just own whatever aws you want or have your own raspberry somewhere and you can host anything and you're actually the owner then of the json you can change it you can just stop paying the bill in a way or the second option of course you have many others but the two main are those ones is using ipfs so you will use some peer-to-peer hyper media protocol that will store your json somewhere and probably also your image and that means that nobody is capable of

really changing it because once you have a hash once you uploaded something it's not going to be changeable right okay so we already saw that it's not an image on the blockchain but is it really a proof of ownership and what people generally imply behind that is that an nft would be the same way as a transaction immutable it's written somewhere inside a block and anybody can see it and and verify it well first of all that's not true for web 2 the web 2 storage we saw it already if i'm owning the server i'm owning your json so i can change it i can delete it i can i can do whatever the hell i want with it but that should be true for ipfs right

because i just said nobody can change it it's decentralized so it's frozen in a way so that should be some kind of proof of ownership of something but then if it's right if the first sentence is okay then who's the authority who's actually deciding that you're owning something well most people actually believe that they're on the protocol level so they believe again that it's some kind of a transaction that you can just go somewhere on meet a scan and just look at it and you will be able to verify it well that's not really what's happening you're on the on the application layer here so you're working with a smart contract the smart contract is owned by

someone you're not at the protocol level you're not here you're not you're not going to be able to just ask the protocol am i owning this nft that's not how it works in the end if we're re really sum it up to something an nft is just a string so for example right here uh i'm taking the bar gap contract i'm calling the tokenware method it's supposed to give me a string that string will represent my json and then i can just check what is behind that string and i will have this this description uh that's for the token number one you can see that my image is an ipfs and i have some attributes i can have some properties and everything but in the end that's literally the only thing that i own i'm

not owning a jpeg i'm not owning anything except that string if i'm owning it but that string is immutable right i mean i i said it before if it's an ipfs that's not changeable nobody can just take take it away from me everybody is owning it in a way but i'm the only one having that string inside my nft well not really that's not how it works the rule here is code is low so that means one thing if i'm the contract owner if i'm the one designing the contract i can do whatever the hell i want with your nft with your ownership i can do absolutely everything if i decided to make me capable of doing that before deploying the contract and even

before even after with in some cases so let's see a very simple example so here as you can see i created an account i have nothing on openc and i'm just going to mint something of course through the magic of editing everything is going super fast and i have my first ball gape cool i can check again on openc i have it it's great i can just verify i can see my event saying that it has been minted from the new address to mine and if i check on polygon scan yeah i have my board app it's cool i mint it in nft okay let's see what i can do now so it's an ipfs of course i added a giveaway to to make it

easier for me to read but basically i'm going to use a specific method that i added in my contract and when i'm refreshing now i have a different nft i change it because i can i just changed the string that is behind it and of course openc has some cache so i can just refresh it and once it's refreshed i should probably yeah it's going to change everything so i was able to change whatever was behind that string even though it was ipfs it doesn't really matter i'm the contract owner here so that's exactly what happened very simple method two lines actually the first one is not even necessary i can just say yeah for that specific token id do something else and as you can see at

the very end it's only owner so i'm the only one capable of doing that so now let's see what i can do i change the metadata can i send an event saying that i transfer something so i'm creating a new transaction okay it's cool and i can see on on polygon scan now that if i refresh oh i lost my nft so i probably transferred it right that's what happened i can see a transfer action right here so that means that i'm not owning it anymore but if i refresh open c i'm still owning that nft so what actually happened here i can see a transfer event but i'm still the owner in a way

so actually it's very simple i just created a method capable of sending the transfer event the transfer event is the event that is triggered and fired once you do you're doing a transfer it's supposed to be uh done only at the time but i can decide that i i can send it anytime i want so i can make you believe that you're not owning or owning something if i want to okay so now let's do a transfer for example so again i'm just going to transfer my nft for real this time i'm not owning any nft anymore so that worked let's check on openc if i refresh okay so now jesus is owning

my nft that's cool i transferred it to him everything worked as expected but if i check actually the transfer my transfer added value so i'm capable of saying that a transfer is payable nobody's really doing it but that's actually possible that doesn't change the fact that my nft is completely valid i can make you pay to transfer something and of course if i want i can just decide that as a as a contract owner i'm not obligated to do it i can just decide that i can send your nft without your approval without nothing just by with this specific line and make you pay if you want to do it of course it's on polygon here so it costs nothing but if it was on ethereum that

would be way more costly so what did we saw just radio so first of all collection information impersonation are a legend everybody is doing it you will you probably have more scams today than you have real nfts specifically on polygon and collection names are not unique if i want i can just change it i can call my nft the way i want this was literally on polygons called board appeal club i can do whatever i want it's not unique nft balances are mostly centralized around events which can be fake and that's what we saw on polygon scan if i send an event saying that you did something everybody will believe that i that you did that just because most people will not take the time to call

the contract verify your ownership on it they will just centralize all their balances around your events they will just listen to every single events that they will they will find on the blockchain talk and rearize can be changed like any other variable uh in a smart contract if i design the contract to be able to do so it's capable to do it i'm the one deciding i'm the contract owner and transfer can be payable of course and they can be initiated on your behalf without your approval that means that i don't need you to give me your approval to do something of course that's going to be true for any random guy but as the contract owner if i decided to i can change it right

and i can transfer things for you and that's actually way more used now because of the migration thing you will migrate your new nft and the owner is just going to burn everything on your behalf and create everything again on the new contract and that's not even talking about proxy and delegation if i want i can create a smart contract that's going to be upgradable so that means that today this is my contract tomorrow it's going to be it's going to do something else i can just add features remove features change everything that's my call again it's a proxy and i can put whatever i want behind it and you we didn't uh see it yet but you can also set this truck i can make you

mint an nft make you pay for it and then i will just decide at the random point that i'm destroying the contract you're not owning anything and i kept the money and so on and so on i we could we could find many many different things that are actually doable so in the end the what you need to understand is that you have no choice but to trust the contract owner is your authority no one on the protocol is capable to know that you're owning something the the contract owner is capable of doing so because it literally designed a function telling you that your balance is x or y so how can ledger help with that

well first of all we added a function almost a year ago now it's clear signing for transfer so anytime you're one-on-one you want to transfer an nft inside legion live it's going to be clear sign on your nano your nano is going to tell you exactly what you're doing and if even though even though it's not possible right now but because we are crafting the transaction but if tomorrow metamask was actually implementing the same thing which they can do if they want they would show you exactly that in your transfer you're actually having a message value so that means that you will add ether or automatic or whatever in your transfer so that's prevented by the killer

signing you will know exactly what you're doing and with metamask only you won't be able to do that and we have one other initiative that is really recent uh it's called ledger market what is ledger market it's a curated distribution channel so we will and pick a few artists uh and do drops with them and it's not just us partnering with people we are actually building the most secure nft marketplace if you want to call it that way in the world right now why that first of all you will have signing for minting so that means that we are going to give you a very specific nano plugin and that nano plug-in will work only with some contracts so only

the contract that we decided to clear sign will be available and and working inside that plugin which means no impersonation is possible i can i cannot just create another contract called the same and you will be able to believe it that's fixing it we also provide a security review on the smart contracts that are deployed by the the artist so by it's done by the dungeon which is our security team inside ledger and we will also for uh with ledger volt which is our enterprise solution smart contract governance on everything so that means that sure you will still have to trust the contract owner but at

the very least they will not be able to you won't find it just a long wall capable of doing everything just by himself it's going to be through governance you will have multisig and they will make sure you can make sure at least that the project is done by a group of people the project is actually designed and and governed by the people that built it not just one guy and if you want that as well it's actually super easy uh ledger is an open platform and that means that you can have your own nano plugin you can do your own clear signing and you can also build your own application that will be available in live which again will have clear signing for everything so

it's open you can you can go on our discord and you can start working with us anytime and that's it if you want to see the the contract and everything it's available on github and you can just scan the qr code if you want thank you [Applause] you