NFT Provenance

NFTs are trivial to clone. The token standard binds a (contract, tokenId) pair to a URI, but nothing at the protocol level says the URI is authentic, the artist is who the listing claims, or the same work has not been minted on five other chains by impostors. Notareum binds an NFT (or an entire collection) to a creator identity via a signed .nota file, then anchors that binding in NotaRegistry where marketplaces and wallets can check it before they render, list, or buy.

What gets bound

Two levels of binding are useful:

Collection-level .nota for the deployed ERC-721/ERC-1155 contract. Proves “this collection was created by this artist/studio”. Issued once per deployment.
Token-level .nota for a specific (contract, tokenId). Proves “this specific edition is authorized by the creator with this metadata”. Issued per mint or per edition.

Collection-level is sufficient for most use cases. Token-level matters for 1-of-1 art, limited editions, and authenticated secondary sales.

Creating a collection `.nota`

import { Notareum } from "@notareum/sdk";

const ntm = Notareum({ provider, signer: artistSigner, contracts });

const collectionNota = await ntm.nota
  .create({
    type: "nft_collection",
    chainId: 1,
    chainName: "ethereum",
    identifier: "0x...NftContractAddress",
    name: "Meridian by Alba Ruiz",
    description: "50-piece generative series, 2026.",
    alias: "meridian.alba.eth",
    resourceMetadata: {
      standard: "ERC-721",
      totalSupply: 50,
      artistName: "Alba Ruiz",
      artistSite: "https://albaruiz.art",
      metadataBaseUri: "ipfs://bafybeigdy...",
      metadataHash: "0xc3ab8ff137...",
      mintedAt: "2026-02-14",
      licenseSpdx: "CC-BY-NC-4.0",
    },
    issuerName: "Alba Ruiz",
    issuerEntityType: "individual",
  })
  .validate()
  .sign(artistSigner);

await ntm.registry.registerResource(collectionNota);
await ntm.verification.requestVerification(collectionNota.resourceId(), {
  level: "enhanced",
});

metadataBaseUri and metadataHash let a consumer check that the contract’s tokenURI output is under the registered base and hashes to the expected root. Any drift signals tampered metadata.

Creating a token `.nota`

const tokenNota = await ntm.nota
  .create({
    type: "nft",
    chainId: 1,
    chainName: "ethereum",
    identifier: "0x...NftContractAddress:7",
    name: "Meridian #7",
    description: "Hand-finished print, edition 7 of 50.",
    resourceMetadata: {
      contract: "0x...NftContractAddress",
      tokenId: "7",
      standard: "ERC-721",
      metadataUri: "ipfs://bafkreib5y...meta7.json",
      metadataHash: "0x9f2a4b1e...",
      mediaUri: "ipfs://bafkreif6x...media7.png",
      mediaHash: "0x48e1c9d0...",
    },
    issuerName: "Alba Ruiz",
    issuerEntityType: "individual",
  })
  .sign(artistSigner);

identifier encodes the composite (contract, tokenId) so the deterministic resource ID is unique per token. The SDK uses : as the separator by convention.

Detecting fakes

A marketplace renders a listing by looking up the collection contract in NotaRegistry:

async function renderListing(contractAddr: string, tokenId: bigint) {
  // 1. Collection-level check
  const colId = ntm.registry.computeResourceId("nft_collection", 1, contractAddr);
  const col = await ntm.registry.getResource(colId);
  if (!col.exists || col.isRevoked) {
    return { status: "unverified", warning: "Unrecognized collection" };
  }

  // 2. Metadata tamper check
  const tokenUri = await nftContract.tokenURI(tokenId);
  const metadata = await fetch(tokenUri).then((r) => r.json());
  if (!tokenUri.startsWith(col.metadataBaseUri)) {
    return { status: "tampered", warning: "tokenURI outside registered base" };
  }

  return {
    status: "verified",
    artist: col.issuerName,
    level: col.level,
    license: col.resourceMetadata.licenseSpdx,
  };
}

A marketplace that enforces this check eliminates the three most common NFT fraud vectors: impostor contracts with the same metadata, metadata swaps after minting, and cross-chain impersonation.

Cross-chain provenance

A single artist often mints the same work on Ethereum, Polygon, Base, and Solana. Notareum represents this with multiple .nota files sharing the same issuer key but different (chainId, identifier) pairs, plus an optional canonicalResource field that points to the original mint:

{
  "resource": {
    "type": "nft_collection",
    "chainId": 137,
    "identifier": "0x...polygonContract",
    "resourceMetadata": {
      "canonicalResource": {
        "chainId": 1,
        "identifier": "0x...ethereumContract"
      },
      "bridgeProof": "ipfs://bafybei...proofofBurn"
    }
  }
}

A wallet can follow canonicalResource to find the original and its verification status. This defeats the “collection was minted on mainnet, fakes mint on L2” class of fraud.

Secondary market receipts

Each sale can produce a receipt .nota containing:

The on-chain transaction hash.
The seller, buyer, and marketplace identities.
Royalty destination (and whether royalties were honored).
Price, currency, and timestamp.

The buyer receives a portable proof of ownership provenance that survives the marketplace going offline.

const receipt = await ntm.nota
  .create({
    type: "transaction",
    chainId: 1,
    chainName: "ethereum",
    identifier: txHash,
    name: "Sale: Meridian #7",
    resourceMetadata: {
      tokenResource: tokenNota.resourceId(),
      seller: sellerAddr,
      buyer: buyerAddr,
      marketplace: "opensea",
      price: "3.25",
      currency: "ETH",
      royaltyPaid: "0.1625",
      royaltyRecipient: artistAddr,
    },
  })
  .sign(marketplaceSigner);

Artist workflows

Identity registration. The artist registers a self-describing .nota of type "address" with an alias (e.g., alba.art). All subsequent collection .nota files come from the same key and inherit reputation.
Studio delegation. A studio can register a multisig as issuer. Attestations from individual artists are layered as additional signatures on the .nota file via the optional coSigners field.
License metadata. SPDX license codes in resourceMetadata.licenseSpdx give marketplaces a machine-readable license badge.

Integration patterns

OpenSea-class marketplaces check collection .nota before rendering a “verified creator” badge.
Wallets flag NFTs from unregistered collections during display.
Aggregators filter phishing airdrops by requiring at least a registered, non-revoked .nota before the token is shown in a user’s inventory.
IP tooling uses licenseSpdx to auto-generate license enforcement pages.

Getting Started

Protocol

Token

SDKs

Guides

Use Cases

Smart Contracts

Reference

Resources

Nft provenance

NFT Provenance

What gets bound

Creating a collection `.nota`

Creating a token `.nota`

Detecting fakes

Cross-chain provenance

Secondary market receipts

Artist workflows

Integration patterns

​NFT Provenance

​What gets bound

​Creating a collection .nota

​Creating a token .nota

​Detecting fakes

​Cross-chain provenance

​Secondary market receipts

​Artist workflows

​Integration patterns

​Related pages

NFT Provenance

What gets bound

Creating a collection `.nota`

Creating a token `.nota`

Detecting fakes

Cross-chain provenance

Secondary market receipts

Artist workflows

Integration patterns

Related pages