I have an NFT contract that uses merkle proofs to ensure that everyone who mints an NFT has been whitelisted. My mint function takes merkleProof as a parameter and runs isValidMerkleProof(merkleProof, whitelistMerkleRoot) to ensure that the minter's address has already been added to the whitelist.
This is a great system, and thank you to whoever invented merkle proofs, and thank you to whoever started using merkle proofs for NFTs, but it can be a little bit inconvenient for NFT drops. In order to do a whitelisted NFT drop, I have to have a sign up period. I collect email addresses for people who are interested in minting. Then I send these people individial discrete links where I collect their Metamask addresses and add their Ethereum addresses to a large array. When this address collection period is finished I make a merkle root of the address array and deploy the NFT with the merkle root set to the value I've calculated.
The problem is that I'm asking the minters to do a lot of steps before they actually get their minted NFT. It would be more convenient if I could just write an NFT solidity contract that only accepts mint function calls from my mint site's domain, like a CORS policy for a solidity smart contract. I could set up Cloudflare protection on my domain (or just add a captcha), so only real humans using a web browser could make contract calls to mint NFTs. Does such a thing exist? Or is there any way more convenient way to mint NFTs in a way that protects against bots?
