Partnered With:

A Paradigm and Hasu study: Guidelines for designing efficient NFT priming Mechanisms

Read this article in 58 Minutes

Starting with Loot, Meebit and other startup examples, what should a good NFT startup meet?

A Guide to Designing Effective NFT Launches

原文作者：Hasu，Anish Agnihotri

Perry Wang, Link News

Blockchain has revolutionized the way open source software is funded, but not all new models work well from the start. In fact, the majority of initial coin offerings (ICOs) from 2016 to 2018 turned out to be very bad cases in which project founders were able to cash in on the money they raised before any products were delivered. The crypto community has learned many lessons since then, and current projects come up with a working product before token offerings, incentived-use of tokens, and decentralized governance.

Non-homogeneous tokens (NFT), it turns out, are another obvious fit for the crypto product market, but they are experiencing their own growing pains. The life cycle of each NFT begins with the start of the NFT (sometimes called cast/MINT or airdrop/drop). In terms of NFT initiation, a new series of NFT is first created, sold and distributed to the buyer, who then decides to hold it or trade it in the secondary market.

As with any first-time sale, NFT launches with a pricing challenge: how to price something that has never been priced before. But unlike most other commodity sales, NFT is more difficult to occur in highly adversarial environments, where the vast nature of these environments (public chains) has turned off inexperienced users. Therefore, developers must design mechanisms that are effective and robust for development efforts.

This article starts with real-world startup examples (all of which have harmed their own users) to determine what a good NFT startup should do. We then break down the startup idea into individual steps and explore the design space for each step. Finally, we provided what we thought was a well-designed startup mechanism for the community to use and evolve.

Instances that harm users

Over time, we began to notice that certain design patterns in NFT startup consistently produced bad results for users.

cheating

When a new family of NFT is launched, the user can interact with its smart contract to create an NFT with a random set of attributes. These attributes tend to have varying scarcity, making some combinations rarer and more valuable than others. For example, only nine out of 10,000 CryptoPunks have ultra-rare "alien" attributes, with the cheapest one currently listed at 35,000 ETH on the market.

Different people get involved in the casting of a new NFT for a variety of reasons, many of them enjoying the excitement of buying a blind box and winning a lottery to hide a rare item. In this sense, NFT casting is simply a continuation of the twist (blind box) mechanic popular in both the analog world (e.g., supplement packs for trading card games) and the digital world (e.g., gear boxes in video games).

People playing Twister tend to make an important assumption: they draw from a random distribution of items and have a real (albeit small) chance of getting a very rare variety. Unfortunately, past NFT coin projects often failed to satisfy this assumption and create true randomness. In practice, highly skilled and motivated groups have been able to use cheating mechanisms to snipe at the rarest items in collections and take them away from honest participants.

We will share two cases of NFT coinage projects being exploited through this model. Both exploits rely on the same two-step process:

, & have spentThe exploiter extracts the metadata of the collection to show the relative frequencies of all features in a single rarity score table. Using this score sheet, they can quickly identify the highest value NFT in the set.

, & have spentThe exploiters then break the randomness of the casting contract and only cast the rare NFT they want with the highest value.

Loot derivatives and chain on the original data stripping

Recently, a project called Loot has taken the NFT world by storm. The seemingly simple project consists of 8,000 loot bags made up of breastplates, feet, armors, helmets, necks, rings, waists and weapons of varying rarity.

All attributes of each item slot are stored directly in the contract, and the minter receives a pseudo-random Bag whose Bag ID is used as a hash value. While these devices have been around forever for as long as Ethereum exists, the metadata stored on the chain also exposes Loot's pseudo-randomness to cheaters. They quickly grabbed the metadata for all 8,000 bags by simulating the randomization function locally, capturing the entire series of pictures (and the rarity of derivatives). Armed with this information, they just need to take advantage of the last remaining weakness of the contract: being able to precisely cast the ID they want, and sniping only the rarest item, Bag.

However, despite the simplicity of this vulnerability attack, there is reason to believe that no one can really exploit the ORIGINAL Loot forged NFT:

Source: https://github.com/Anish-Agnihotri/blog-effective-nft-launches-data/tree/master/01-exploitable-fairness/loot

We kept looking at the rarity of the kit bag until the very end of the coin, and we found that the rare items were well distributed throughout the coin's time horizon, indicating that there was not a serious case of exploitation.

There are two possible explanations for Loot not being exploited:

, & have spentIt's a brand new contract, so people aren't ready or have time to find loopholes.

, & have spentThe extractable value (EV) of the Foundry Loot is unclear, as the value of the collection only exploded on the secondary market a few days later. The nNFT collection took 2.5 hours to sell out, further supporting this hypothesis.

However, as Loot prices continued to rise, a number of spin-offs, including More Loot and Extension Loot, began to appear, most of which were small forks of the original Loot contract. The new NFT series inherits Loot's weaknesses, but has a higher market value and attracts a higher level of attention. The fairness (or lack thereof) of these forged NFTS makes a big difference.

More Loot

According to the casting time, the distribution of rare items in More Loot is compared with the original Loot, and it can be found that the signs of cheating in More Loot become very obvious. After only a few blocks, all the rare NFT's had been minted, and subsequent minters were left with scraps, largely unaware that sophisticated users had tampered with the NFT launch.

Source: https://github.com/Anish-Agnihotri/blog-effective-nft-launches-data/tree/master/01-exploitable-fairness/mLoot

Below: The red line indicates the point at which Anish posted his rarity score on Twitter, and the race for the available rare packs begins.

Source: https://github.com/Anish-Agnihotri/blog-effective-nft-launches-data/tree/master/01-exploitable-fairness/mLoot

Also, as the supply of More Loot continues to swell, you can expect cheaters to pre-score future dai gear and compete to cast high-scoring bags.

Extension Loot

Similar to More Loot, Extension Loot has a single address for casting five of the ten rarest equipment bags (all cast in NFT red highlighted). Uniquely, these coins are hidden in close sight, as cheaters distribute them and available gear bags over time, and then continuously target rare gear bags.

Source: https://github.com/Anish-Agnihotri/blog-effective-nft-launches-data/tree/master/01-exploitable-fairness/xLoot

Meebit NFT and off-chain raw data cheating

Meebits was a highly anticipated NFT coin project, made up of 20,000 unique 3D characters from Larva Labs, the creator of CryptoPunks.

Larva Labs knew that savvy users could use metadata sets to calculate rarity and attack rare NFT. To solve this problem, they designed their own website so that buyers could see the full metadata of each Meebit NFT, but only after it had been cast.

While the site explicitly hides uncast Meebit, someone examined the source code and found that Larva Labs had extracted metadata from IPFS. They used this information to crawl IPFS to extract metadata from uncast Meebit NFT to find the most desired NFT individuals.

Still, Larvalabs doesn't make things easy for developers: Unlike Loot, users can't create specific Meebit ids. Instead, using randomness to generate hashing on the chain (which theoretically could still be cheated by miners) makes it harder for that particular user to cast rare Meebits.

However, cheaters are more powerful. They wrote a contract to buy Meebit NFT, looked at their ID, and "swiped initial." Specifically, the Meebit contract is a standard ERC721 contract with mint(), which returns a random Meebit ID. The developer's contract calls Mint, checks the Meebit ID returned against their rarity list, and restores the transaction if it doesn't exceed a certain rarity score (sample code). Using this trick, they only pay about 0.03 ETH to check each ID, instead of 2.5 ETH directly buying each Meebit.

While the attackers consumed many failed transactions in the process and incurred gas charges as a result, they made a profit of about 400 ETH. Today, the same cheater can send their trade through a Flashbots bundle and only pay the miner if they get one of the ids they want -- making the trade restore completely free.

The attacker minted and sold Meebit #16647, which had super rare "visitor" features

Gas auction

In September, ethereum's base cost per Gas exceeded 1,250 Gwei in seven epochs. Shockingly, all seven of these incidents resulted in the ethereum network crashing due to the highly anticipated NFT launch.

From left to right: G 'Evols, The Sevens, Sipher, Galaxy Eggs, Omnimorphs + ArtBlocks Democracity, Galactic Apes, King Frogs

Most of these NFT starts use a fixed-price, first-come, first-served (FCFS) mechanism. Due to low prices and excessive demand, the competition to acquire such NFT changes from contract sale to Gas auction competition in memory pool.

One example is The Sevens NFT airdrop event, a highly anticipated NFT collection of 7,000 dystopian character heads. With an initial price of 0.07 ETH per NFT, eager participants are eager to access the contract. Gas prices peaked at 12,246 Gwei in just six minutes, with the median participant paying about 1.49 ETH per NFT, The top 5% individuals paid more than 2.44 ETH of Gas per NFT just to cast the NFT from the contract.

During Sevens NFT casting, block base costs skyrocketed

The problem with Gas auctions is not only that they make ethereum more challenging to use, but by "abusing" the common memory pool in this way, they create negative externalities for all Ethereum users. It also forces users to pay different amounts for the same NFT, hurting users by causing thousands of transactions to fail due to insufficient bids.

Advantages of highly skilled users

As we've all seen before, Ethereum is a dark forest where highly skilled antagonists are always on the prowl for a quick profit. NFT minting projects, especially rare minting projects where buyers expect a premium in the secondary market after minting, offer lucrative opportunities for skilled parties to outperform ordinary participants.

These participants interact directly with NFT minting contracts through robotic and automated strategies, often bypassing the front end and sometimes even the memory pool.

The TIMEPieces NFT airdrop is a good real-world example. Hackers operating advanced robots examined the NFt.time.com front-end source code prior to the NFT casting process. This way, they were able to find deployed minting contracts on the main network and build robots hours in advance. These robots therefore had a significant jump start advantage during the casting of the NFT, which was completely sold out in less than three minutes. By the time the average participant connected their wallet and submitted the transaction, they had received nothing.

In addition, some participants use Flashbots to bypass the Ethereum common memory pool and submit transactions directly to miners. While the TIMEPieces contract limits participants to casting a maximum of 10 NFT per address, the robot manipulator 0x35... Ce5 planned ahead and allocated funds to five wallets, sniping 50 NFT in a single Flashbots package. Even after tipping the miners 20 ETH (bringing their average minting cost to 0.5 ETH per NFT/ NFT), the robot operator still made a profit of nearly 120 ETH when the batch of NFT started to enter the secondary market.

The bundle includes minting transactions from five different addresses, bypassing the limit of 10 NFT minted per address

In addition, because the participant uses Flashbots, which can recover failed transactions at zero cost, they are not affected by the failed transactions we demonstrated earlier. The other nearly 10,962 participants were quite different, making 12,743 resets across 100 blocks, and because their attempts were unsuccessful, they lost a cumulative 252.62 ETH (nearly $800,000) in transaction fees.

The pursuit of equity leads to high Gas costs and low efficiency

An efficient NFT casting mechanism means that it is easy to use for all participants -- ideally with just a few steps and simple implementation. One of the common pitfalls of coin projects implementing first-come-first-served distribution alternatives is that they introduce complexity and increase the number of on-chain transactions the user must make.

An example is the Jay Pegs Auto Mart $DONA auction on Miso. While this minting activity pioneered bulk auction NFT distribution and effectively demonstrated what fair metadata generation would look like in practice, it did so at the expense of high Gas costs and transaction efficiency.

To participate in the NFT casting process, users must make at least four on-chain transactions within eight days:

, & have spentInitially, users submit ETH to Miso's bulk auction without knowing how many DONA tokens they will receive (depending on the final clearing price)

, & have spentAfter the auction, users must claim their $DONA tokens

, & have spentAt this point, all users receive tokens that are either too small to mint NFT, just enough, or too much. Based on the results of a survey of 1,363 participating minters, we found that 273 got too little,0 had just enough, and 1,090 had too much (the surplus left over from minting a token).

, & have spentUsers with too few tokens must trade to earn the necessary surplus from Sushiswap.

, & have spentUsers with too many tokens can choose to approve $DONA tokens for transactions and then trade through Sushiswap to sell their surplus tokens.

, & have spentWhen the user has enough DONA to cast an NFT, they can approve the NFT contract to spend their DONA and then destroy their DONA token to cast the NFT.

, & have spentFinally, metadata is allocated to the NFT in bulk and cannot unilaterally reveal a person's NFT.

While this mechanism strives to be fair, it makes it very difficult for users to participate, and GAS is costly and inefficient.

Exclusive coinage

The Obenbenbenne project seeks equity by valuing collections by NFT collectors and enthusiasts, drawing on the strength of their communities. Often this involves measuring the concentration of tokens among holders. The ideal collecting situation tends to be less concentrated, favouring individual participants rather than being dominated by whales.

However, in recent coin projects, there has been a new trend towards the introduction of batch coinage, whereby participants can mint more than one token simultaneously in a single transaction. By this mechanism, whale founders can cast many NFT with less Gas overhead.

One example in practice is the Stoner Cats Airdrop, a collectible NFT coin project that supports Hollywood actress Mila Kunis and her friends in their animated short films, allowing up to 20 NFT to be cast at a time. In view of this function, 89% of the NFTS were cast by the batch casting function, and nearly 31% of the Stoner Cats were produced by wealthy individuals who cast 20 NFTS at a time.

Moreover, all NFTS sold at a fixed price implicitly exclude people who have less capital capacity than the clearing price. Given the high cost of casting, this reduces the equity of distribution in favour of those with deeper pockets.

A trusted operator

Whether implementing a centralized lottery to prevent Gas wars or Chainlink to improve fairness, a common tradeoff is to introduce the assumption of trust to third parties. The more off-chain infrastructure NFT minting projects must rely on, the more trust users need to have in centralized off-chain entities.

Small goals for a perfect start

By looking at these startup activities and analyzing the problems that people have encountered in practice, we can now come up with what we think are the six ideal attributes of NFT startup. We don't expect this to be an exhaustive list, but it's a starting point.

Fairness without cheating: NFT startup must have true randomness to ensure that cheating users cannot sniop the rarest items at the expense of less sophisticated users.

No competition: Whenever an NFT (or indeed any commodity) is sold for less than its fair market price, it becomes what Ethereum co-founder Vitalik Buterin calls an "auction by other means." In practice, buyers compete to get their deals into blocks as quickly as possible, or attach large bribes to incentivize miners. Anyone who auctions by other means has deep knowledge of blockchain and can use power tools like robots, private relays like Flashbots or Eden, or even submit directly to miners.

Time zone free: Usually a "first come, first served" model is launched at a specific block height and then sold out in a short time. No matter what block height is chosen, it will always be to the disadvantage of users in other time zones who are currently sleeping or busy at work. Therefore, the release time span should not be so short that people can participate without changing their daily lives.

Gas savings: The cost of on-chain transactions (especially on Ethereum) is very expensive, so a good NFT startup should minimize the number of transactions a user has to make.

Inclusivity and resistance to SYbil attacks: Generally, it is in the best interest of NFT creators to ensure that releases are open to a diverse group of coin holders, even if it initially results in slightly slower market clearing. That's because a vibrant community ultimately drives the value of collectibles on the secondary market.

No trust: Of course, in summary, the startup mechanism should be able to preserve the properties of the underlying blockchain. This means it must provide these benefits without encountering regulation or requiring excessive assumptions of trust from operators.

"Not open is safe" should not be an excuse for the poor design of the start-up mechanism

Most NFT boosters have one or more of these problems in theory, but in practice there is insufficient demand for these problems. This is a case of "not making it public is safe".

For example, if a new NFT series has a low perceived market value, there may be no competitive conditions that lead to a bidding war in the memory pool, no need to buy preferential block space, and no incentive for predatory users to cheat on it. Similarly, if there is too much demand for a new NFT series, the series may sell out too quickly to have time to write custom software for it or cheat on its fairness.

While too little security demand is a problem, we believe that people should always design their NFT starts to be robust in all market conditions, and in particular not to rely too heavily on product lines that sell out quickly as a means of protecting them from cheating.

NFT startup details dismantlement

While we now know that we need a great release, we still don't know how to get there. This path (or, as we shall see, many paths) can be slowly revealed by unpicking what is actually happening behind the scenes.

Each NFT startup consists of four steps:

, & have spentBidding: Sales are activated and users submit bids to carriers (which can be smart contracts).

, & have spentLiquidation: The operator matches the collected bids with the remaining supply, sets a liquidation price and selects the winning bidder.

, & have spentDistribution: Bid winners can pick up their newly minted NFT (or receive it from the operator).

, & have spentDisclosure of raw data: The carrier discloses NFT attribute data.

Take Loot as an example. Loot's first come, first served sales are highly online in block 13,108,877. Dom, the creator of the collectible, set the sale price to zero in the smart contract, but the user still had to bid the auction through gas. In each block, miners make a fresh bid to liquidate the remaining supply, determining who wins and who loses. Users who bid successfully receive the NFT in the same transaction.

Most users do not know the specific properties of NFT until they receive it. In practice, however, a highly skilled user can read NFT properties from the smart contract before casting, allowing them to snipe the rarest items in the collection. This indicates that metadata cannot be displayed until the item has been purchased and eventually liquidated, regardless of whether the other steps occur sequentially or consecutively.

Next, we'll explore the options available to NFT developers at each of the four steps. We discuss the effect of each option on the desired properties to filter out the bad choices and the good design choices.

Step 1: Bid

At this stage, the operator collects bids (for example, requisitions) from its users.

Sequential vs. sequential liquidation

First, operators must decide whether they want to bid and liquidate consecutively in the same or two non-overlapping phases.

Any first-come, first-served, fixed-price sale (which has taken the form of most NFT launches so far) is an example of ongoing liquidation. For each block, miners look at bids and liquidate based on the remaining supply.

There are several problems with this mechanism: if the operator overestimates the clearing price of the NFT, the NFT is too expensive and may not sell all of it. If operators underestimate the clearing price of NFT, those NFT prices are too cheap, and users will compete on speed (who has the most direct access to block space) or Gas price (who can pay miners the most for their transactions). As discussed earlier, this can lead to significant financial losses due to trading failures and greatly benefit highly skilled participants. If necessary, the first option can be mitigated by routing all user transactions to Flashbots RPC and letting the auction take place in an environment where there is no cost to failed transactions.

When the second option is used, bidding and liquidation take place in two non-overlapping phases. In practice, operators first collect all bids and then match them with available supply to clear at a fair price. This method includes mechanisms such as bulk auctions or lotteries. An example of this approach is Jay Pegs Auto Mart, which gives users a week to submit their bids before the market clears.

The sequential approach has multiple benefits, consistent with the goals we have outlined:

, & have spentNo competition: Users have enough time to submit their bids, and the outcome is determined by how much the user is willing to pay, not by speed or skill.

, & have spentTime zone free: This approach respects people who live or work in other time zones.

In addition, since there is no Gas auction, there is no negative externality to other network users.

However, this approach has drawbacks, such as requiring more on-chain transactions (depending on the auction design) or reducing the enjoyment of participants, as they now have to wait longer. We recommend that the latter concern be allayed by not allowing the bidding period to be too long, perhaps preferably no more than 48 hours.

On-chain bidding vs. off-chain bidding

After deciding whether to liquidate consecutively or sequentially, the next choice is whether users submit their bids on-chain or off-chain.

As we will see, the current NFT startup typically collects bids on the chain because it is the simplest and can efficiently allow miners to liquidate for the winning bidder and declare the remaining bids unsuccessful. If we assume that the network itself is uncensored, it also means that there are strong guarantees that no valid bids will be missed from the sale.

However, off-chain collection bidding is also possible. In this process, users sign a message using their private key that contains information such as their on-chain address, the number of tokens or tickets they want to buy, and their highest bid. They send this message to the carrier instead of executing it on the chain, using their signature to validate it.

However, operators can use these bids to clear the off-chain market or bundle winning deals and submit them to contracts for execution on-chain. Either way, buyers need to have a degree of trust in the operator to ensure that the right bid is executed.

The final approach combines off-chain collection bidding with on-chain screening of winning bidders, combining a robust, gas-efficient and flexible approach. The only thing users need to trust is that the operator won't miss any bids when they submit them on the chain -- a relatively weak assumption.

Who is allowed to bid?

The third decision to be made is who is allowed to bid and how many people are allowed to participate. As discussed in the goals of inclusion and anti-SYbil attacks, the project side may want to ensure that different user groups buy their items. In this regard, they limit the amount of NFT available to users with specific characteristics, or reserve a portion of NFT exclusively for holders of the existing NFT community.

Such KYC rules are easy to implement when bidding occurs off-chain -- just require the user to prove some information before submitting a signature to the server. On-chain KYC is more complex, but Gitcoin's privacy efforts prove that projects like it are making progress.

Even if a project doesn't want KYC of any kind, they can still take steps to ensure that large and small users can buy the same number of tokens for the same amount of money. This principle is generally undermined when contracts allow users to buy or receive many NFT in the same transaction, because Whales can split the same gas charge by buying more tokens and therefore pay less per token than smaller users. To mitigate this, it is usually a good idea to limit the number of tokens purchased per address or per transaction.

A bid cost

In addition, operators must decide when users must pay for NFT tokens -- along with bids, or after the market has cleared?

In the latter case, the user simply holds the token during the bidding phase and waits for the market to clear, and then they can complete the purchase within a certain time window. One project that uses this method in conjunction with off-chain bidding is Parallel. While it works well in a quieter market, this model can become a competitive condition when demand is very high, with users wanting to keep as many tokens as possible because there is no cost to doing so.

To mitigate competition conditions, the bidding itself should be cost-linked. The best solution here is to let the user submit a bid only after locking up funds in smart contracts from the same address. Then, if the bid is unsuccessful, the operator can decide whether to refund the money (similar to an exchange limit order) or keep the bid (similar to an uncashed raffle ticket).

Bid granularity

Finally, they must decide how much granularity they want the user to bid for. When there are failed bids (because demand exceeds supply), further decisions must be made about what makes a winner and what makes a loser. Here are three viable options:

, & have spent"Dumb-ass" bulk auctions: people pledge a certain amount of ETH without further instructions. In the liquidation phase, the number of NFT is divided by the total amount of ETH submitted, and each person receives a fragmented token in the form of ERC-20, which can later be exchanged for ERC-721 NFT. Jay Pegs Auto Mart uses this method and it has the advantage of no failed bids. The downside, however, is that it requires three additional on-chain transactions -- two for selling or buying tokens to reach a useful number (for example, one "full" ERC-20 token) and one for redeemable NFT. Most importantly, this approach does not allow buyers to express a bid as a desired number of tokens -- a feature that almost every market expects.

, & have spent"Smart" bulk auctions: SpankChain used a similar, but arguably even better, approach for its ICO years ago. Unlike Jay Peg, SpankChain collects bids on the price per token for a specified number of tokens. At the end of the bidding period, they calculated an off-chain strike price and submitted it to the smart contract along with the winning bid, and the winning bidder could take SPANK or ETH if he or she didn't win. The downside of this approach is that the computational complexity of matching all bids is so great that it can only be done off-chain, which requires a certain amount of trust in the operator.

, & have spent"Lottery" : Finally, there is a lottery or lotto model in which users bid by purchasing tickets or making reservations. Winners are then chosen at random from all ticket pools. This way, the user will either receive a full token or nothing, saving Gas charges for three additional transactions like Jay Peg's $DONA. This means that users with weaker financial resources can also enter. However, it introduces randomness into sales, which some users may prefer and others may not.

Step 2: Liquidation

At this stage, the operator (or someone acting in the operator's name) matches the bidding and availability to determine who will buy NFT and who will not.

On-chain clearing vs off-chain clearing

The last major node is who can choose the winner from all the bidding pools. In the first come, first served model, which is done by miners, we have explained that it is prone to corruption in several ways.

In Jay Peg's clearing scheme, computational complexity is low, low enough to run on the chain in a completely trustless manner.

In SpankChain's model, the winner is chosen entirely below the chain. While bidders can't sell for more than they want (smart contracts ensure that), they still have to trust that operators won't push them to their highest bid, similar to how sandwich attacks on decentralized exchanges work.

The "lottery" method is easiest to clear because you only need a random number (for example, from Chainlink VRF). But also asking for randomness introduces another assumption of trust: the person who generates this randomness may favor his own bid over others. Conversely, this is not possible when the winning bid is just the highest bid.

Step 3: Distribute

After the market is cleared, operators must mint tokens and hand them over to users, who, using this model, are required to return the money for any failed bids. This step usually involves Gas efficiency and preventing competition conditions.

Simultaneous vs. interval settlement

If operators want to prevent their customers from claiming the NFT at the same time and causing gas bills to spike, they can reuse the same randomness as in the clearing process and let people claim in batches. This solves the problem of collective action causing Gas bills to skyrocket, because it is better for users not to claim all NFTS at the same time. Still, curiosity about their metadata and who will be the first to flip the NFT on the secondary market is always likely to create competitive conditions anyway. This means that interval settlement also increases the user's wait time.

Claim vs. receive NFT tokens

The only other thing to mention in the distribution is whether users have to claim the tokens themselves, or whether the carrier can simply send them over time. The latter is a variant of interval settlement, but with the added benefit that the user doesn't have to do anything. The aforementioned Parallel launch uses this approach and works fine, except that the user is required to add "shipping" when initially paying for NFT.

Step 4: Disclose the original data

Finally, once the NFT token is distributed, its metadata can be displayed. This step must be the last of the four stages in NFT startup. It also can't share the last step with other steps (for example, by bundling payment, distribution, and raw data display in the same transaction, as Meebit does), because bad actors can cheat by "swiping the beginning" by rereading transactions, undermining fairness. There must be a gap of at least one block between payment and metadata presentation to make transaction rollback impossible, although you can also choose to increase this gap to prevent reorganization attacks.

When to disclose metadata

We have now determined that minting NFT and disclosing its metadata cannot occur in the same transaction, which raises the question of when to disclose it. This is important not only for fairness, but also for user experience and gas efficiency. Generally speaking, there are three options:

Full Set Disclosure: In full set disclosure, operators wait until all NFT's for the set have been cast before disclosing metadata. This approach has high gas efficiency and requires only a random number, which can then be used to scramble the workorder ID metadata without further action by the user.

However, it has obvious disadvantages. That is, the user must wait until all NFTS have been minted before they can see the metadata for their tokens. If an upper limit is set on when to expose metadata (for example, 24 hours), some users may still not be able to cast in time to sell out NFT collectibles.

NFT one-by-one disclosure: To improve UX for full disclosure, carriers can also allow users to display randomness one by one for NFT. This is more attractive because users can "open" their NFT shortly after purchase. It also allows "unopened" NFTS to be traded in the secondary market (which is popular in trading card games like MTG).

However, this approach imposes the burden of requiring the user to make additional on-chain transactions, such as calling the Chainlink VRF and applying random numbers to their OWN NFT. Even for users who are not particularly eager to disclose metadata, or who are not interested in trading unopened NFT, this is an unavoidable expense.

Bulk disclosure: We propose the concept of bulk disclosure as a potential middle ground. In this approach, users can cast indefinitely, but they can also disclose their NFT metadata in the next block if they wish. Each new random number that receives the request automatically discloses metadata for all cast and unallocated NFT, revealing them at nearly the same constant cost.

Thus, users with a high time preference can choose to pay for additional on-chain transactions to disclose metadata, which benefits all users before them. If no user opts for disclosure, the carrier can also follow a schedule, such as every hour.

Along with theMachine source

After deciding when to disclose the metadata, the question remains where to get the randomness from. The two options we suggest are to use Chainlink VRF or commit- Reveal scheme mechanisms.

With the former, you can access verifiable on-chain random sources on demand. Using any disclosure mechanism, you can call Chainlink to request randomness, and once satisfied, use the randomly generated number as the input value for the metadata calculation. This will ensure that it is random for each NFT.

For the latter mechanism, operators can create one random number (for full disclosure) or multiple random numbers (for each NFT or batch disclosure) and submit their hash values in advance of the sale. Once the NFT is cast, the operator can reveal the numbers so that anyone can hash them to verify their authenticity. Nonetheless, this approach requires a certain amount of trust in the operator that they will not exploit advance insight into random numbers to create the best NFT. To minimize the need for trust, we recommend that some independent randomization still be done in casting order.

In addition, for off-chain metadata, operators can choose to submit a hash of the full metadata (all OF the NFT's ID-related attributes) rather than submit a random number. This ensures that metadata is predetermined and cannot be tampered with during or after casting. However, independent randomization in casting order is also necessary to prevent operators from taking advantage of the right to know to cheat.

Our practical operation reference manual

We provide a practical reference manual in which we consider a good balance between all attributes and are easy to understand and adjust.

Bidding: In our hands-on reference manual, users can bid by purchasing raffle tickets. The duration of the draw is determined by the operator (we recommend 24-48 hours). The price of each ticket includes gas charges as well as the price per NFT specified by the operator. The latter act as a "margin" and refund tickets to all losers after the market clears. Anti-sybil attacks are generated in three ways: gas per transaction, capital cost for locked funds, and maximum votes per address.

Liquidation: At the end of the bidding period, winners equal to the number of NFT available must be drawn from all ticket pools. First, anyone can call the collectEntropy() to get a random number from the Chainlink VRF. This randomness is used for "shuffleEntries()", which uses the Fisher-Yates lottery mechanism. Anyone can call this function to ensure activity and socialize gas costs (e.g., to be borne by Whales).

Distribution: After all winners have been drawn, users can collect NFT from their winning tickets indefinitely, and they will receive a refund for their lost tickets. Both take place in the same transaction. Operators can now start withdrawing the proceeds from winning tickets.

Metadata disclosure: Users can disclose their NFT metadata in the block after they claim it. Anyone can request a new random number, and it will automatically disclose metadata for all cast and unassigned NFT. Users with a high time preference can pay immediately to disclose metadata for the benefit of all users.

conclusion

In this article, we present real-world examples to show how poorly designed NFT startup results in suboptimal results for users. But when a project clearly defines their goals and takes the time to deconstruct what steps a release actually takes, many designs are possible -- and almost all of them are much better than the fixed-price, first-come, first-served, net-crowded NFT sales we're used to today.

If you want to get anything out of this article, follow these three rules:

, & have spentThe fairness of non-cheats is the most critical attribute of NFT startup with random metadata. With great randomness, never reveal the metadata of an NFT until it has been purchased and settled.

, & have spentCompetition conditions hurt users, both those who minted coins and those who did not. Use sequential bidding and liquidation (for example, lotteries or bulk auctions) to solve this problem.

, & have spentConsider cost effectiveness from minute one. Keep asking yourself whether any steps that are currently happening on the chain can also happen off the chain to save your users money. Assuming that users can establish a degree of trust in the operator, the chain steps can include bidding and market clearing. Batch disclosure should be considered in the metadata disclosure stage.

We'd love to see NFT developers start experimenting with some of these ideas, leading to a wider variety of products in the real world. Finally, we'd like to give a big thank you to those Big Vs who have been sharing their suggestions with the NFT community to help improve the quality of NFT launches:

, & have spentVitalik -- for his explanation of FCFS fixed price selling issues

, & have spentFairDrop -- Share their fair draw proof-of-concept designs

, & have spentDotta - Tips for building a great front end

, & have spentJay Pegs Auto Mart and SpankChain -- Test novel auction methods

, & have spentParallel - fully demonstrates the best practices of under-chain lottery

, & have spent0xmons - Advice and tools for designing fair launches