Identifying Authentic NFTs (Especially Against Attackers)

Michael Blau Posted March 9, 2022

As an NFT collector, you should care about on-chain provenance. The most authentic provenance for an NFT is when it is initially minted directly from a creator’s wallet or a smart contract that the creator owns. However, with a few clever smart contract illusions, someone could manipulate NFT provenance using a technique known as Sleep Minting.

Sleep Minting is when a scammer mints an NFT directly to a famous creator’s wallet with permission to reclaim or pull the NFT back out of the creator’s wallet. This creates the appearance that (1) a creator authentically minted an NFT to themselves; and then (2) sent that NFT to a scammer. Based on “on-chain” provenance, the scammer can claim they own an NFT minted by a famous creator and sell it for a higher value.

How does this work technically? First, it is essential to understand how a smart contract stores NFT provenance and ownership. Anybody can query an NFT smart contract to determine who the current owner of an NFT is using the ownerOf(tokenId) function from the ERC-721 Standard. You could even query for an NFT owner at a specific block number by varying the eth_call RPC method parameters. However, the simplest way to see changes in ownership is to look at ERC-721 Transfer Event logs.

My a16z Crypto colleague Daren Matsuoka wrote a great Twitter thread about Event logs and how they work. A Transfer Event log is a message sent to the outside world by a smart contract containing details about an NFT transfer (who the NFT is transferring FROM, who the NFT is transferring TO, and the transferred TOKEN ID). Transfer Event logs provide an efficient way to check an NFT’s provenance.

The deception of Sleep Minting comes from the fact that you can emit any piece of data in an Event log. One would expect that if YOU send a transaction to transfer an NFT, then your address should be in the Event log as the “from” field. However, that is not the case when a scammer reclaims a sleep-minted NFT from a famous creator. A scammer could artificially place the famous creator’s address in a Transfer Event’s “from” field.

In more detail, here is how Sleep Minting works:

  1. A scammer would mint an NFT to a famous creator’s wallet but maintain permissions to reclaim or pull that NFT out of the creator’s wallet.
  2. The scammer would issue a transaction that reclaims the NFT from the famous creator. Even though the scammer is sending this transaction (and not the creator), they can artificially place the creator’s address in the “from” field of a Transfer Event. On the surface, it would appear as if the famous creator legitimately transferred an NFT to the scammer.
  3. The scammer now holds an NFT that appears to be authentically created and previously owned by a famous creator, and they can sell that NFT at a higher price.

I would also recommend reading this great walkthrough of a real Sleep Minting attack.

Thanks to Forta, I built an agent that helps detect potential NFT Sleep Minting. Forta created a network for real-time web3 threat detection! Developers can build Forta agents (or threat-detection bots) to alert any suspicious activity on the blockchain. The agent checks to see if the address that sent a transaction to transfer an NFT differs from the “from” address emitted in a Transfer Event log. If they are different, there is a possibility that the NFT in question was sleep minted.

You can see a live monitor for my agent here and the agent code here

Subscribing to NFT Sleep Minting alerts may help prevent you from collecting a fraudulent NFT. If you ever see an agent alert referring to a specific NFT contract address on the Forta Explorer Agent page, you may want to think twice before purchasing an NFT from that contract.

Want More a16z Crypto?

Your go-to-guide to the next internet.

Learn More
Recommended For You

Expert News by a16z

We have built a network of experts who are deeply rooted in technology and how it’s shaping our future. Subscribe to our newsletters to receive their perspectives.

Views expressed in “posts” (including podcasts, videos, and social media) are those of the individual a16z personnel quoted therein and are not the views of a16z Capital Management, L.L.C. (“a16z”) or its respective affiliates. a16z Capital Management is an investment adviser registered with the Securities and Exchange Commission. Registration as an investment adviser does not imply any special skill or training. The posts are not directed to any investors or potential investors, and do not constitute an offer to sell — or a solicitation of an offer to buy — any securities, and may not be used or relied upon in evaluating the merits of any investment.

The contents in here — and available on any associated distribution platforms and any public a16z online social media accounts, platforms, and sites (collectively, “content distribution outlets”) — should not be construed as or relied upon in any manner as investment, legal, tax, or other advice. You should consult your own advisers as to legal, business, tax, and other related matters concerning any investment. Any projections, estimates, forecasts, targets, prospects and/or opinions expressed in these materials are subject to change without notice and may differ or be contrary to opinions expressed by others. Any charts provided here or on a16z content distribution outlets are for informational purposes only, and should not be relied upon when making any investment decision. Certain information contained in here has been obtained from third-party sources, including from portfolio companies of funds managed by a16z. While taken from sources believed to be reliable, a16z has not independently verified such information and makes no representations about the enduring accuracy of the information or its appropriateness for a given situation. In addition, posts may include third-party advertisements; a16z has not reviewed such advertisements and does not endorse any advertising content contained therein. All content speaks only as of the date indicated.

Under no circumstances should any posts or other information provided on this website — or on associated content distribution outlets — be construed as an offer soliciting the purchase or sale of any security or interest in any pooled investment vehicle sponsored, discussed, or mentioned by a16z personnel. Nor should it be construed as an offer to provide investment advisory services; an offer to invest in an a16z-managed pooled investment vehicle will be made separately and only by means of the confidential offering documents of the specific pooled investment vehicles — which should be read in their entirety, and only to those who, among other requirements, meet certain qualifications under federal securities laws. Such investors, defined as accredited investors and qualified purchasers, are generally deemed capable of evaluating the merits and risks of prospective investments and financial matters.

There can be no assurances that a16z’s investment objectives will be achieved or investment strategies will be successful. Any investment in a vehicle managed by a16z involves a high degree of risk including the risk that the entire amount invested is lost. Any investments or portfolio companies mentioned, referred to, or described are not representative of all investments in vehicles managed by a16z and there can be no assurance that the investments will be profitable or that other investments made in the future will have similar characteristics or results. A list of investments made by funds managed by a16z is available here: https://a16z.com/investments/. Past results of a16z’s investments, pooled investment vehicles, or investment strategies are not necessarily indicative of future results. Excluded from this list are investments (and certain publicly traded cryptocurrencies/ digital assets) for which the issuer has not provided permission for a16z to disclose publicly. As for its investments in any cryptocurrency or token project, a16z is acting in its own financial interest, not necessarily in the interests of other token holders. a16z has no special role in any of these projects or power over their management. a16z does not undertake to continue to have any involvement in these projects other than as an investor and token holder, and other token holders should not expect that it will or rely on it to have any particular involvement.

With respect to funds managed by a16z that are registered in Japan, a16z will provide to any member of the Japanese public a copy of such documents as are required to be made publicly available pursuant to Article 63 of the Financial Instruments and Exchange Act of Japan. Please contact compliance@a16z.com to request such documents.

For other site terms of use, please go here. Additional important information about a16z, including our Form ADV Part 2A Brochure, is available at the SEC’s website: http://www.adviserinfo.sec.gov.