NFTs were never about the tech

Remember NFTs? Yeah, the premise was unusually empty even by the standards of over-hyped and under-utilized technologies, but let’s try to take it seriously as a technology for a moment.

The basic idea behind the Non-Fungible Token (NFT) is that while digital files are infinitely copyable, the NFT provides a way to establish ownership over a unique token associated with a particular file. The blockchain records who owns the token and any subsequent transfers. The token itself doesn’t actually contain the file; it (usually) just points to metadata that points to a file stored somewhere else. The blockchain is inefficient enough without trying to load it up with JPEGs. The tokens are non-fungible because each token is distinct; ownership of one implies nothing about ownership of any other.

So far, so good. The primary type of file people ended up associating with NFTs was ugly, randomly generated images. The most famous collection was the Bored Ape Yacht Club, a particularly grotesque series of cartoon hominoids dressed up in various costumes.

A weakness of NFTs is that they don’t inherently identify the file they supposedly establish ownership over, beyond “here’s where to find it”. There are various ways to deal with this. The Bored Ape Yacht Club used cryptographic hashes. Each of the 10,000 ape images was hashed, the hashes were put in a particular order, and the whole thing was hashed again, with the final result recorded on the blockchain. Anyone could therefore download the apes later, perform the same calculation, and confirm that these were in fact the same ugly hominoids, in the same order, that the creators had committed to at the beginning.

That’s the theory, anyway.

In 2022, software developer Christopher Hranj wanted to learn more about NFT provenance. He figured verifying the provenance of the Bored Apes would be the NFT equivalent of “hello world”.

And so the community around the most famous NFT collection in the world learned something that day: thirty-two out of 10,000 ape hashes did not match the published provenance data. And thirty-one of those thirty-two mismatches were the same hash, which should be effectively impossible if they were actually hashes of thirty-one different apes.

So what happened?

In a follow-up post, he gave the explanation, discovered by Twitter user @kittenpurrrrrr: when the Bored Ape developers were generating the hashes, they were rate limited while downloading the images. Thirty-one of the bad hashes were actually the same “HTTP 429 - Too Many Requests” error page. The remaining bad hash was a generic “HTTP 500 - Internal Server Error” page.

Apparently no one had noticed that the provenance data were wrong for ten months after the most famous NFT project in the world launched. No one had bothered to check.

It was never about the tech.