6

I'm core backend engineer at CandyPay (https://twitter.com/candypayfun), we're trying to bring the seamless mobile-native UX to Solana's NFT ecosystem with the help of Solana Pay. We have recently created a Gasless NFT drop (https://www.solaneyes.com/address/GnUeJeGFYnk669oGedBvV1t3qByD8eLttjLSSgCvwGRJ) for Dilli Hackerhouse, but unfortunately, all the NFTs got minted and drained our payer's wallet funds.

The attacker had sent mass POST requests to our API's /mint route and fetched the raw base58 transaction object from the route's response. The attacker had simulated and signed the transaction programmatically via newly-created wallets. The minted NFTs are been then listed on MagicEden.

The obvious solution would be to add ratelimiting, but it isn't the permanent solution to this issue.

Is there any kind of way to exactly know whether the incoming API request is from Phantom/Solflare/Glow? With the help of this we can easily filter out the spam API requests

Additional context

  1. https://twitter.com/umang_veerma/status/1568123608031166465
  2. https://magiceden.io/marketplace/dilli_hackerhouse
Improve this question

2 Answers 2

Reset to default
3

FWIW I think this is going to be very tricky. Anything wallets added to the request would be trivial for anyone making their own HTTP request to duplicate. And there's no room for security by obscurity here, they can see the requests their own phone is making. The only secret wallets have AFAIK is your private key, but of course the person who drained you would have the private key for all their wallets too. So signing with that wouldn't help.

The only solution I can think of would be for wallets to each generate a keypair, and publish the public key. They could then sign their requests with their private key, and you could verify it using their published public key. Downsides: difficult to co-ordinate, you'd have to verify against each wallet's key, and you'd expose the used wallet to the API. I don't think it's a realistic solution.

In your case specifically, the only restriction I can think of that you could do server-side is based on time - only return the mint transaction during the time people should be scanning the codes. But that doesn't protect you against someone inside the hacker house.

I opened an issue on the Solana Pay repo in case anyone has a clever idea for how this could be solved in the protocol: https://github.com/solana-labs/solana-pay/issues/157

Improve this answer
1

You could maybe let the minters sign a message first? I think cli doesnt support that yet but phantom does. With that message you could drop them a token which allows them to mint? Not sure if it would work, just an idea.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.