NFTs and Decentralized Storage

In a previous article I showed you the risks of owning an NFT when its assets are stored on a regular server (AWS, Dropbox, etc.). In our story, Bob, the creator of the NFT, was able to play some tricks on Jim, the owner of the NFT, because he had complete control over the server where the assets of the NFT (image and metadata) were stored.

Today we are going to explore alternatives for storing NFT assets that take away control from Bob by using decentralized storage and economic incentives. At the center of it all is a technology called IPFS (Interplanetary File System), a network of decentralized storage.

The Interplanetary File System (IPFS)

IPFS is a network of computers with lots of storage capacity. IPFS is not a blockchain and can be used in non crypto projects. One of the key characteristics of IPFS is that, when a file gets added to an IPFS node, the file gets replicated (copied) into other nodes of the network.

In the image above, Bob, the creator of the NFT, instead of storing his NFT assets on a regular server he puts them on an IPFS node that he controls. I (David) also have an IPFS node that’s connected to my browser (Brave browser allows you to do that very easily) and because I’m interested in NFTs, one day I come across the NFT created by Bob and load it on my browser. Because my browser and my IPFS node are connected, the NFT assets get replicated to my local IPFS node. Next time that I’m using my browser to see Bob’s NFT, my browser will get the NFT assets from my local IPFS node and not from Bob’s node. Even if Bob decides to delete the assets, I’ll still have access to them because they are stored locally on my computer.

Some time later, Mike, who has a similar setup as I (Brave browser + IPFS node), tries to load the NFT on his browser. Even if at this point the assets were deleted from Bob’s node, Mike can still get the assets from my local IPFS node creating yet another replica on his machine.

Not every IPFS node stores all the data available on other nodes of the network. In the image above Olga uses his IPFS for non crypto related projects so Bob’s NFT assets never get replicated on her machine.

For a regular person who’s only casually browsing an NFT marketplace like OpenSea, this whole setup of having a special browser connected to an IPFS node is too complex. Not to worry, OpenSea and many websites related to NFTs do all the plumbing under the hood to make it completely transparent to the end user. A user doesn’t need to know what IPFS is or that the NFT assets are stored there, it just works. The only requirement is for Bob to add the files of his NFT to an IPFS node during the minting process.

Does this finally solve the issue we discussed in the previous article of Bob deleting the NFT assets from his server or even shutting the server down? Not yet, but we will get there. For now we need to understand data permanence on IPFS and the concept of “pinning”.

Data Permanence on IPFS

To continue our story, at this stage Bob has removed the NFT assets from his IPFS node but the assets are safely replicated on my and Mike’s IPFS nodes for anyone to read.

Even if me and Mike never attempt to manually remove the NFT assets from our IPFS node, those files won’t stay there forever, they will only stay there as long as they’re needed. If Mike stops paying attention to NFTs for a while and instead browses different content on IPFS, his node will start to run out of space and it will start removing “old” content. This means that the NFT assets might get removed eventually from Mike’s IPFS node. The same might happen with my (David) node. At that point, no node on the IPFS network will have the assets so no one will be able to retrieve them.

Are we back to square one then? Not quite, IPFS provides a mechanism to “pin” files, that is, to keep the files on an IPFS node permanently or until we unpin them.

In this case, even if the NFT assets technically become “old” or not relevant for me, the files won’t be automatically removed given the chance for some other node on the network to fetch and replicate it. But why would I want to permanently store a file if it’s not relevant for me anymore? I would do it for a profit.

Pinata: An IPFS Pinning Service

Pinata (this is a misspelling of the Spanish word “Piñata”) is a company that operates a number of IPFS nodes and allows its customers to upload and “pin” files in their nodes for a monthly fee. As long as Bob (the creator of the NFT) pays the monthly fees to Pinata, the NFT assets are guaranteed to be available on the IPFS network. Jim, our protagonist from the previous article and current owner of the NFT, can be relieved to know that the assets of his NFT are always going to be available. Or are they?

What happens if Bob stops paying Pinata for its services? The files will be unpinned and thus susceptible to eventually disappear from the network as in our previous scenario. Jeez, we are not making progress here, are we?

Pinata is not the only layer that exists on top of IPFS, Arweave is a crypto project that promises storage of files on IPFS in “perpetuity” with a single up front payment.

Arweave

How can anyone promise storage in perpetuity? First of all, the fees charged by Arweave are higher than the fees charged by Pinata but that’s not the interesting part. The interesting part is that Arweave invests that money to generate recurring revenue. This ongoing revenue and the fact that the cost of storage decreases rapidly as times goes by, makes it possible that with a single payment they can promise the storage of a file for 200 years. Not technically in perpetuity but longer than any human lifespan.

The network of IPFS nodes that participate on the Arweave network are a different set of nodes than the generic network of IPFS nodes used by Pinata. The people who maintain IPFS nodes on Arweave get paid every time they prove that they are indeed storing the assets of our NFT. That ongoing economic incentive is what keeps the network alive and our files safe.

Going back to our example, once Bob pays for the storage of the NFT he’s minting on Arweave, the files will be there “forever”. Those files are no longer under Bob’s control and he can’t remove them from the network or even modify them. Arweave, as a crypto related project, enforces the immutability of the files stored on its network.

Not every single file will be available on every single node on Arweave but as long as one node has the files, the NFT is safe. Those nodes who decide to store the files will be economically rewarded on an ongoing basis so there’s an incentive for node operators to store as many files as possible for as long as possible even at the cost of expanding their storage capacity of their machines.

Jim can finally be relieved that, if the assets of the NFT he’s buying are stored on Arweave, those assets will always be available and there’s nothing Bob can do to trick him or scam him.

Conclusion

People tend to think that because an NFT is “crypto” all the data that describe the NFT is secure and immutable. As we have seen, that’s not true. The information of who owns what NFT is immutable as it lives in a smart contract but the assets that describe an NFT, like its image or metadata, can be stored on a regular server where files can be removed or modified at will by whoever has access to it.

Decentralized storage with IPFS and Pinata is a popular alternative with NFTs but it still has shortcomings that could put the NFT assets in jeopardy. Only Arweave presents a complete solution of immutability and availability for those assets. The next time you are shopping for an NFT, don’t forget to check how its assets are being stored. It could be the difference between a profitable investment and a painful rug pull.