Best Practices for Verifying Ownership of an NFT ERC-721 Token

Question

I am developing a Smart Contract (SC) and a front-end Dapp which will be used to sell some NFT ERC-721 tokens. When a user/address buys one of the NFT tokens, the token will be minted to his benefit by the SC, while my Dapp will register the said purchase in a local database. Considering that a user could potentially sell his token at a later date without going through my front-end Dapp, what is the best practice to synchronise the token ownership for a specific user, found in the SC with my local database? Should I query the SC every time the user accesses the site and wishes to display his tokens owned in the front-end Dapp? Wouldn't this take too long? Should I query the SC only if the user tries to sell one of his tokens in order to verify if he is the legitimate owner?

Thank you. J

Answer 1

this is a security check. actually there is no way for you to rapidly check the balance of the user without consuming gas. so you should have a logical security check before sending or spending or exchanging tokens in the SC. just put a assert,require, revert before using the balance of the user and if it failed due to insufficient balance, then update the balance of user. and inside the DApp you can check the balance of user rapidly without consuming gas.

Answer 2

The answer for this is simple, put the token URI via api of your dapp, then save the token id on your database everytime mint success. If anyone publicly mint through bscscan or ethscan or any block explorer, it will be invalid and unusable. Like process of banning.