I have an NFT contract that uses merkle proofs to ensure that everyone who mints an NFT has been whitelisted. My mint function takes merkleProof as a parameter and runs isValidMerkleProof(merkleProof, whitelistMerkleRoot) to ensure that the minter's address has already been added to the whitelist.

This is a great system, and thank you to whoever invented merkle proofs, and thank you to whoever started using merkle proofs for NFTs, but it can be a little bit inconvenient for NFT drops. In order to do a whitelisted NFT drop, I have to have a sign up period. I collect email addresses for people who are interested in minting. Then I send these people individial discrete links where I collect their Metamask addresses and add their Ethereum addresses to a large array. When this address collection period is finished I make a merkle root of the address array and deploy the NFT with the merkle root set to the value I've calculated.

The problem is that I'm asking the minters to do a lot of steps before they actually get their minted NFT. It would be more convenient if I could just write an NFT solidity contract that only accepts mint function calls from my mint site's domain, like a CORS policy for a solidity smart contract. I could set up Cloudflare protection on my domain (or just add a captcha), so only real humans using a web browser could make contract calls to mint NFTs. Does such a thing exist? Or is there any way more convenient way to mint NFTs in a way that protects against bots?

1 Answer 1


In this type of centralized minting one solution is for the backend to sign a message with the recipient address and the tokens.

The user then call the contract with the signature. It is validated and proceed to mint the tokens. To prevent abuse the contract should make sure the signature isn't reused.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.