Buying and selling these items involves contract permissions that most participants never examine, and the details determine what can go wrong.
Listing without transferring
Items generally remain in the seller's wallet while listed.
Which requires granting the marketplace contract permission to transfer them on sale.
That permission persists after the listing is removed unless explicitly revoked.
Signature-based listings
Many marketplaces use off-chain signed orders that anyone can execute on chain.
Which avoids gas costs for listing and means a signed order remains executable until it expires or is cancelled.
Cancelling generally requires an on-chain transaction, which people skip because it costs money.
Old signed orders at stale prices have been executed against sellers who believed they had delisted.
Phishing through signatures
Malicious sites request signatures that constitute sale orders at zero or near-zero prices.
Which appears harmless because signing does not cost anything.
This has been the mechanism behind a substantial share of high-value losses in this category.
Royalties
Creator fees are enforced by marketplace policy in most cases rather than by the token contract.
Which is why they became optional when marketplaces competed.
Contract-level enforcement exists and restricts which venues can trade the item.
Metadata and permanence
The token holds a reference, and the referenced content lives elsewhere.
Which means the item's appearance depends on someone continuing to host it.
Content-addressed storage guarantees integrity and does not guarantee availability without pinning.
Provenance
Ownership history is on chain and verifiable.
Which is the genuine capability here and is frequently the least discussed.
Verifying that a collection contract is the official one is the corresponding responsibility, since impostor collections are trivial to create.
Wash trading
Trading between controlled addresses to inflate apparent volume.
Which has been documented at substantial scale on several venues.
Volume figures for a collection should be treated with corresponding caution.
Practical steps
Review and revoke marketplace approvals periodically, read what you sign, and verify contract addresses from official sources.
Aggregators
Interfaces sourcing listings from multiple venues.
Which requires approvals to each underlying marketplace contract.
Users frequently accumulate approvals they are unaware of through these interfaces.
Escrow models
Some venues take custody during listing rather than using approvals.
Which removes the stale signature problem and introduces custody risk.
Neither approach is strictly safer, and knowing which is in use changes what you should check.
Fractionalisation
Splitting ownership of an item into fungible tokens.
Which raises securities questions in several jurisdictions.
Regulatory attention to this specific structure has been explicit in some markets.
Lending against items
Using an item as collateral, either through peer-to-peer agreements or pooled protocols.
Which requires a price for an illiquid unique asset, a genuinely hard valuation problem.
Floor price is the usual proxy and is manipulable in thin collections.
Practical hygiene
Use a separate wallet for interacting with unfamiliar contracts, review approvals regularly, and never sign a message you cannot read.
Verifying a collection
Contract address from the creator's own channels rather than from search or from a marketplace listing alone.
Which is the check that defeats impostor collections.
Verification badges on marketplaces are helpful and are applied by the marketplace rather than being cryptographic proof.
Bidding mechanics
Offers generally require wrapping the native asset so it can be transferred by contract.
Which is why bidding involves an extra token and an extra approval.
Outstanding bids remain executable, so cancelling bids you no longer want is a real maintenance task.
Gas and timing
Minting events with fixed supply produce fee competition.
Which has historically produced very high costs and failed transactions that still cost money.
Allowlist and staged mint designs exist specifically to reduce this.
Storage practice
Content-addressed storage with pinning by multiple parties, or fully on-chain encoding.
Which determines whether the item survives the issuer's disappearance.
Checking where metadata resolves takes one lookup and is rarely done before purchase.
Summary
The permissions granted are the risk, and reviewing them periodically is the mitigation.
Tax treatment
Disposals are generally taxable events, and the treatment of these specific assets varies by jurisdiction.
Which includes questions about collectible classification and about creator income.
Records at the time of each transaction are far easier than reconstruction afterwards.
Closing
The permissions are the risk, the provenance is the capability, and both are checkable.
Wallet separation
Holding valuable items in a wallet that never interacts with unfamiliar contracts.
Which is the single most effective practice available and requires only discipline.
Transfers between your own wallets cost a fee and are considerably cheaper than the alternative.
Approval review
Tools listing outstanding approvals per address are freely available and take minutes to use.
Almost every large loss in this category traces back to a permission granted without being read, which makes reviewing approvals the highest-return habit available.
One last point
Provenance verification is the genuine capability these systems provide, and it requires checking the contract address against an official source rather than trusting a listing.