You don't even own the hash. You just own a database entry pointing at the hash.

There is no mechanism on the Blockchain preventing someone else creating a new NFT with the exact same hash.

I'd argue you don't even own the database entry. You own _a private key for a wallet that appears in_ the database entry for the hash of the image.

But to truly _own_ something, all the cryptographic guarantees in the world won't change the fact that true ownership can only be enforced through violence. And if your private key can be stolen by hackers in countries without extradition treaties, one could argue that anything digital is only "owned" in the absolute weakest sense of the word: no one has tried disputing it yet.

What about the same url? Or one with query parameter adds?

What's to prevent another NFT from pointing to the same data and copying the hash?

The centralised marketplaces themselves (like OpenSea) are able to and might try to police duplicate NFTs, or other counterfeit near-matches. I'm not actually sure if they actually do.

But on the blockchain itself, the NFT is just a smart contract (bit of code, bit of data) that knows it's current owner, it's name and a URI pointing at the image. There zero mechanism preventing duplicates.

Hell, it's such an unregulated market that the NFT might be based on a custom smart contract with a backdoor that allows the creator to steal it back at any time.

Ok, yeah, that's what I thought. So someone could sell a multimillion-dollar NFT, then someone else could duplicate it manually and "re-sell" it, and if they didn't do proper due diligence...

This is was enables art to happen: https://smart-contracts.host/

I don't think any sha256 collision has ever been found. That seems kind of the smallest problem.