Verify the media digest in NEAR NFT metadata

A media URL can return different bytes after a CDN update. When NEP-177 metadata includes media_hash, the original digest provides an independent check on the retrieved asset.

Resolve the media field and retain the original bytes

Read the token metadata and the collection’s base_uri where applicable. Resolve the media reference and download the asset unchanged to downloaded-media.bin. An image preview that has been resized or recompressed will have different bytes from the referenced media.

import base64, hashlib

with open("downloaded-media.bin", "rb") as asset:
    digest = hashlib.sha256(asset.read()).digest()
print(base64.b64encode(digest).decode("ascii"))

Compare identical digest encodings

Compare the printed base64 string with media_hash. The algorithm hashes the file bytes with SHA-256 and encodes the 32-byte digest in base64. Encoding a printable hexadecimal digest instead produces a different value. Keep the token ID, observed block and URL alongside the result.

A missing digest leaves integrity unverified. For externally referenced metadata, reference_hash refers to that metadata document; it is a separate check from the media payload.

Sources