Here are some thoughts:
Blink journey:
1: the user uses a builder or a blink metadata JSON file generator, generating a format similar to solana blinks.
Sample from a live solana blink: https://www.quick-blinks.xyz/api/actions/mint?create={"code":"H4sIAAAAAAAAA5WQb0vDMBDGv0oodL6Z7ZaxTQdlbNMhIjpwf5hvJGvONrZL2iRdt4nf3aSVgiCIkFzujie/3JMPRzOdgjNyZhKIBnRL1AlNU8YT5bQdCiqULNNMcCPZigJRwS804gAUaYESLkoUm23yUFBAO3gTEtDJKMMauKtYbVQoQHnBwuS7gwinKAJdl4xH5jm2J5GdJdY6UyPfL8vSq+5c1ne84+nsv3I4ar+SjguZBi6eVxrvPYtaZYD7g1YeDPsGl0kWWlzH69iShNbH8qffDdMxsgL0/PTQiFYy/WsMkjG/Fit/z7geK+A0cIdTF2OrMofbm5hYUap0btZvLNM2NBtrnsks0RLwzMSSpCnoCaUSlGq43R7NH8uuKvBquV2sD/liQOL1lbjTUXwQgBMcnhN5vC429y8NqvqSBmF922J4Y5z/eMW4/w/f+fwCBQDG3EkCAAA="} with the format being: https://docs.dialect.to/documentation/actions/specification/action-types
Problem statement: So now we have generated the format, how do we distribute it in a decentralized way that does not rely on fetching it from a centralized domain?
2: in order to avoid centralized solutions an option would be to upload the JSON file to ipfs, ideally using crust(Crust Storage 101 · Crust Wiki), this JSON blob contains the pallet call to use and substrate chain to use(so that blinks can work/trigger pallet calls on all chains)
3: a link gets generated in an easy to parse format such as:
polkalink://<cid of uploaded file>
The link format can be whatever is most liked by the community
4: the users browser wallet detects the link by scanning the current website(polkadot-extension/packages/extension/src/detectlinks.ts at c3717383230f046905fd67cba5625c5ad15e2d68 · XcmSend/polkadot-extension · GitHub), if a link is detected(with a regex like:
/polkalink:\/\/([A-Za-z0-9]{46})/g, it will download the JSON metadata file from ipfs and insert a html tag that is rendered after the metadata specs In the JSON blob. Getting the input fields, the pallet call, the image link etc from the downloaded json file.
The browser extension also needs to verify that all fields in the file doesn’t contain any malicious script tags. So proper Input sanitization/escaping all malicious tags that may inject or trigger tags.
5: the html is now rendered and once the user press the button it will trigger the browser wallet to prompt for an transaction to sign
Twitter problems:
Anyone can create a “send me all your coins” button on twitter and in order to scam the user.
A recent interesting case study of malicious content on twitter is the $hacked token on solana:https://x.com/2600/status/1836480305634439334?t=K_i4WtUjbjtzGhcqcXkvAQ&s=19
Where a third party twitter app had post access to its connected tweeter accounts. Causing a publication(2600 magazine) that has been publishing security related content since the 1980’ies to have problems with twitter,. So one could assume that malicious links will always be posted by trusted accounts
Solana is aware of these problems and has implemented a trusted authority in the role of repository. Having blinks manually reviewed before published to there blink distribution server/repo.
An alternative solution could be to force the user to sign the JSON metadata before uploading it. In this case browser extension providers could verify that the blink was issued by someone that has a legit identity on-chain. “Has the above link been creaeted by a trusted account and signed by the actual person behind it?”
Goals:
Not rely on a single centralized site.
Have an open standard for the Json metadata that everyone can implement.
ps.
it would also be super cool if this can be combined with .dot domains, .DOT Authority Registration for the Polkadot App so a user can generate a link that ends with .dot and the .dot domain can point to the metadata file for the blink
~ flipchan
