Checking a collection

Anyone can mint an NFT with any picture and any name. Copying a popular collection's art takes minutes. So the name and the picture tell you nothing.

Two things cannot be copied:

• The issuer address. The account the NFT was issued from.
• The taxon. The series number the issuer gave the collection.

Both are sealed into the NFT's ID. A copycat has a different issuer address, every time.

So the first check is plain. Find the issuer address from the project itself: its own website or its own official account. Then compare it, character by character, with the NFT in front of you. Do not take the address from a message, a reply or an ad.

Next, read the settings the issuer chose at mint:

• Transfer fee. The share of each resale that goes to the issuer, from 0% to 50%.
• Burnable. If on, the issuer can destroy the NFT while you hold it.
• Mutable. If on, the issuer can change what the NFT points to.
• Transferable. If off, you can only send it back to the issuer.

None of these is wrong by itself. A ticket should be burnable. A game item may need to change. The point is to know before you pay, and to see that it matches what the project says.

Read one NFT. nft_info on a Clio server, with the nft_id:

An NFT belongs to a collection only if both issuer and nft_taxon match the real one. A taxon of 0 can mean the issuer uses no collections.

Read the issuer. account_info on the issuer address:

• Domain: hex for a domain name. On its own it proves nothing, since any account can set any string. Fetch https://<domain>/.well-known/xrp-ledger.toml and look for the issuer address under [[ACCOUNTS]]. xrpl.org calls a match in both directions strong evidence that one party controls both.
• NFTokenMinter: another account allowed to mint, and to modify mutable NFTs, for this issuer.
• MintedNFTokens and BurnedNFTokens: how many NFTs this issuer has minted across all its taxons, and how many of those were burned.

Can the supply grow? An issuer can mint more NFTs in the same taxon at any time, unless it can no longer sign. A blackholed issuer has all four of these: master key disabled (lsfDisableMaster), RegularKey set to rrrrrrrrrrrrrrrrrrrrrhoLvTp or rrrrrrrrrrrrrrrrrrrrBZbvji, no signer list and no delegates. It must also have no NFTokenMinter left. A blackholed issuer collects no transfer fees and cannot modify or burn.

Check the URI. uri in nft_info shows where the art or metadata lives. A link to a server the issuer runs can serve different content later, even when the NFT is not mutable.

Related: Transfer fees and flags, Checking a token before you trust it.