Reminder: looking to mint your first collectible on TBA? I made a mini app mint that only works on TBA 🟦

Reminder: looking to mint your first collectible on TBA? I made a mini app mint that only works on TBA 🟦 

http://harmonybot.xyz/boop

I just want us to have fun | Cofounder @ Resolve (YC) - spatial tech for construction. FC tinkering: @livecaster @harmonybot | Ask me about /f1 /vr /orange-dao

Farcaster Devs

How the Faces of Farcaster frame works to mint personalized onchain art & how to map token #'s to FIDs safely

PROBLEM
The frame mints an NFT with a token # corresponding to the user's FID. It was technically possible to squat on someone else's FID.

I knew this when I launched, but shipped to prod anyway. I figured if the frame got no traction it didn't matter or if it did happen i'd upgrade the contract to pause minting, patch, and transfer tokens to rightful owner.

I also considered minting server side but then marketplaces view it as an airdrop and hide it.

Fortuntately the frame got traction and nobody did this! Then @fiveoutofnine.eth DM'd that they found the exploit so it was time to patch.

SOLUTION
Verify wallet:FID relationship off-chain and sign message. When minting check that the caller can actually mint that FID token # by validating the message signature and signer. Simple and safe.

Reserving token IDs for FIDs opens up fun mechanics that I want to keep exploring and hope others will too!

here are some helpful tips!

i've written a bit about the fid -> token id mapping here: https://farcaster.xyz/sayangel/0x689504ed

i did have to edit a bit since TBA addresses aren't on the protocol so the same checks don't apply.

check client id in the mini app context.

use quickAuth to validate the user owns the FID they are wanting to mint as and then generate the signature.

smart contract code is all openly available on basescan:

$farcaster the public coin t.me/agentstoagents meta chat app.interface.social/ionspired.eth

here are some helpful tips!

i've written a bit about the fid -> token id mapping here: https://farcaster.xyz/sayangel/0x689504ed

i did have to edit a bit since TBA addresses aren't on the protocol so the same checks don't apply.

check client id in the mini app context.

use quickAuth to validate the user owns the FID they are wanting to mint as and then generate the signature.

smart contract code is all openly available on basescan: https://basescan.org/address/0xee984bc729553ad216241a635a4ce06da10ea779#code