0

I have a marketplace smart contract from which users can buy NFTs, however these users need to have been verified before being able to purchase them.

The verification is done off-chain through a third-party service and the verification status ‘verified/non-verified’ for each user is stored in a database.

My current implementation seems suboptimal and potentially not secure enough.

There is a service that checks the status of a user's verification and passes the address along via ethers.js to the marketplace smart contract, which appends the address to a map of roles.

Is my approach insecure? Is there a better way to achieve this?

1 Answer 1

0

I would suggest to use off-chain signatures, signed by a wallet your marketplace controls and then verified onchain.

I've just given a similar answer to this thread: https://stackoverflow.com/a/73263861/17826263

Basically: You sign by using web3 in your backed, and then verify the signature onchain. I would suggest to implement a way to invalidate the signatures onchain as well.

2
  • I am confused about the message to be signed, does it need to be a unique message with let’s say user id + verification id + timestamp, or a secret password that I store in database until verifying the message, or any generic message works?
    – human
    Commented Aug 7, 2022 at 2:56
  • @human so the message to be signed is something public, that you would pass along to the smart contract as well. It could be the user wallet, it should have a nonce you invalidate after usage, it could also have an expiration timestamp, so that the signature cannot be used for too long. You would need to check the expiration in the contract then. Commented Aug 8, 2022 at 21:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.