Nounce View about flow-nft

[austinkline]

Thanks @bjartek! Yeah there is talk about something similar to this on Ethereum marketplace contracts following issues with listings that folks didn't know were valid still (off-chain models like OpenSea being the main risks). The use of some kind of nonce is in discussion so that if I make multiple listings with the same nonce, one being filled will invalidate the others automatically. There's definitely an even better option as highlighted above that basically invalidates all orders whenever an item is transferred at all which should help secure things from folks losing their NFTs if they put an item back into a wallet that listed that same item previously.

[bjartek]

I am wondering if this can just be part of identity #56

[joshuahannan]

Finally seeing this in relation to #56. How would we increment the nonce?

[bjartek]

In my example nft I have a counter I increment in the deposit function.

[joshuahannan]

My first impression is that this is a bit unnecessary. Is the problem you're saying it solves really that big of a problem? Maybe I am just unaware

[bluesign]

So StoreFront will check this nonce?

[austinkline]

My first impression is that this is a bit unnecessary. Is the problem you're saying it solves really that big of a problem? Maybe I am just unaware

yes, this was a huge problem on ethereum around December/January. Old listings for assets that are now very highly valued were sniped at prices from 6+ months prior (sometimes less than 5% of their current value). Here's a breakdown of the timing:

1. I list an nft for sale
2. I move the nft because I either no longer want to sell it or I need to get it to another wallet (maybe this is for a topshot challenge or something). The listing I made is no longer valid in that it cannot be matched on-chain
3. Time passes
4. Eventually, I move the nft back to the wallet that I listed it with
5. That listing is now valid, anyone can fill it so long as it hasn't expired provided that it has an expiration

A nonce approach (or something similarly named) is there to make sure that when you move something, anything that could move or tamper with that item is no longer valid, storefronts are just one example. It is a defensive mechanism to give dapps a way to not expire things while still preventing this vulnerability

[bluesign]

I agree with the problem but I think nonce is too smart idea to be adopted. Who should adopt this? Marketplace, StoreFront, NFT standard?

[austinkline]

The NFT standard would have to implement it. Any application which facilitates movement of the nft could then check for it. This cannot be maintained by the storefront because this issue can persist across marketplaces or just from me withdrawing the nft manually and then putting it back later

[joshuahannan]

I think this probably needs a bit more discussion before adding it as a view. I also added it to the list of potential improvements to the NFT standard in that issue so it is documented there.

[bluesign]

@austinkline yeah agreed, but also I think if NFT standard implements this, then StoreFront also has to be updated to use the nonce. If not we are at square one. I agree with @joshuahannan on this, as this will require multi parties and changes to NFT standard, maybe better to make it another discussion. Half baked solution will be worse than no solution.

[austinkline]

Absolutely on needing more discussion! Happy to pick that up wherever necessary.

[satyamakgec]

Hey @bjartek, I really like the idea myself but just want to know what other problem statement you can think it can solve because we can consider listing problems to be the UX problem and it can be solved using some smart projects like https://epns.io/ that will help to solve the problem and let the users know when to delete there pending listings.

[bjartek]

IMHO a view should solve a single problem. Nounce solved the problem of detecting if an nft has moved since the last you saw it.

EPNS looks exciting, are there plans to support flow here? Creating Reactive Blockchain applications that can react to events would be lovely.

[satyamakgec]

@bjartek we can reach out to them and ask them to support the flow or can someone from the community can build something to provide the native support for the same. The only reason I am thinking that it would not be worth introducing the same is that this problem can be better solved by better tooling. Interested to hear your thoughts.

[satyamakgec]

@bjartek I am in favour of closing this issue and achieving this through tooling like EPNS. WDYT ?

[satyamakgec]

Closing this issue, If anything interesting comes up again we can re-open this.

[bjartek]

I have to expose this view in .finds own shared views then and just tell people to implement it if they want this added security. Works for me.

[satyamakgec]

added security in listing the NFTs over the NFT storefront ?

[bjartek]

There are other ways of selling and NFT then the storefront. Or even selling it. I was peoposing an alternative to stop one usecase as described in this issue. I can live with the outcome as is.