If metadata can be changed, how can the uniqueness of an NFT can be guaranteed?

Question

Let's say, there's manufacturer that produces luxury watches, and he uses Cardano NFTs to track their authenticity. He embeds unique serial number of a watch into metadata of NFT. One watch - one NFT, that is.

But a bad actor could:

• buy the simplest but real watch along with an NFT from the manufacture
• create a replica of the most expensive watch of the manufacturer
• change the metadata of that NFT -- the serial number and photo of a watch, such that metadata would describe a replica
• sell the replica along with the updated NFT which now embeds metadata which describes the expensive replica

What prevents this from being possible?

Answer 1

The uniqueness of an NFT comes from its minting policy, not the metadata. If you create a script that can only mint one token, then you know any token with that address as its currency symbol is unique, and thus non-fungible.

One possible solution to your problem is a smart contract that holds the proof-of-ownership NFT for you. When the watch maker manufactures a watch, they generate an NFT and engrave the currency symbol on that watch. They then add that NFT to the contract with your address as the owner datum. If you ever sell the watch, you can use the contract to change the "owner" datum to the new owner.

Answer 2

@Mitchell Turner is right.

I want to add this. In Cardano you can mint NFTs using:

• Native scripts: using this option you're the owner of the policy keys (files) to mint a NFT with that policy Id. Unless your keys are stolen, then nobody else could use them to mint a NFT using the same policy Id. That means, nobody can update the metadata of your NFTs.

• Plutus scripts: using this option you can create any kind of validation in the minting policy, i.e. allowing to mint only from certain addresses. Although, so far (as I know) it's not possible to attach metadata to your NFTs using Plutus scripts, but you can create NFTs: currency symbols + token name

Regarding to these terms currency symbol, token name, policy id and asset name, please take a look on this: What are the differences between policyId & currencySymbol and assetName & tokenName?