How to restrict access to a public mint function to only to users to who have completed certain tasks (eg., tap and earn )

Question

I have written an ERC20 smart contract where I have a onlyOwner mint function where only the owner is allowed to mint tokens and I also have a public mint function where users can able to mint specific amount of tokens as per the work they have done.

Here there's a vulnerability in my code where users who have not done any tasks can also be able to claim tokens since this is a public function.

Here is the detailed flow of my application

1. Users login to my application

2. They watch my TV for certain time

3. Will be rewarded some amount of tokens as per the time they have watched

4. Users can now be able to claim the rewards by paying gas fees (This is the only place where users directly interact with the blockchain).

Answer 1

New to this forum, sorry that I can't leave this as a comment. Consider this to be just a comment please as it is not fully detailed in everyway.

Smart contracts cannot directly know what is going on off-chain. Therefore there is no way for your contract to check if a certain address can/cannot mint tokens spontaneously.

What you can try is

Update the authority from you front/back end

Call another onlyOwner function to tell the contract, 'hey, this guy can mint tokens' like:

mapping (address => bool) public canMintTokens;
function update(address newUser) external onlyOwner{
    canMintTokens[newUser] = true;
}

and add a check in your mint function for users to check if the mapping value for their address is true.(and change it back into false after they call the function.

This would sure cost more gas for the owner of the contract must constantly interacting with the contract to keep it up-to-date. Better it using batch-set ups or external databases. But anyway, without interacting with the contract, it is not possible to control the process.