SkateSpots/SHOP_VERIFICATION_ANALYSIS.md

Shop Ownership Verification - Analysis

Date: December 30, 2025
Issue: NIP-05 alone is weak proof of shop ownership

---

🔍 CURRENT SITUATION

Problem: Anyone can get a NIP-05 and claim to own a shop
Risk: Fake shop listings, impersonation, scams
Current: Just checking if user.metadata.nip05 exists

---

💡 YOUR PROPOSAL

NIP-39: External Identity Links

What it does: Links Nostr identity to GitHub, Twitter, domain, etc.
For shops: Link to shop's Instagram, website domain, business accounts
Trust signal: "Verified on Instagram @supremeskate since 2015"

Example:

{
  "kind": 0,
  "content": {...},
  "tags": [
    ["i", "github:supremeskate", "proof-url"],
    ["i", "twitter:supremeskate", "proof-url"],
    ["i", "https://supremeskate.com", "proof-url"]
  ]
}

NIP-42: Relay Authentication

What it does: Relay can ask client to prove identity
For shops: Behind-the-scenes verification without user friction
Use case: Relay confirms ownership before allowing shop edits

---

🎯 RECOMMENDATION

Multi-Layer Verification Approach

Tier 1: Basic Listing (Anyone)

• ✅ No verification needed
• Anyone can add a shop to the map
• Marked as "Community Added"
• No special privileges

Tier 2: NIP-05 Verified

• ✅ Has NIP-05 identifier
• Can claim "Verified Member" status
• Not shop owner, just verified user
• Reduces spam

Tier 3: Shop Owner (NIP-39 + NIP-05)

• ✅ NIP-05 identifier
• ✅ NIP-39 external identity (shop website, Instagram, etc.)
• Gets "Verified Owner" badge
• Can edit shop details
• Can add products/contact info
• Full shop management

---

📊 IMPLEMENTATION OPTIONS

Option A: NIP-05 Only (Current)

Pros: Simple, already implemented
Cons: Weak verification, easy to fake
Effort: 0 hours (done)
Cost: $0

Option B: Add NIP-39 Verification

Pros: Real proof of ownership, hard to fake
Cons: Requires shop to have social media or website
Effort: 2-3 hours
Cost: $10-15

What to build:

1. Parse NIP-39 tags from profile
2. Create verification UI showing linked accounts
3. Add "Verified Owner" badge for shops with NIP-39
4. Show linked accounts (Instagram, website) on shop pages
5. Require at least 1 external identity for shop ownership

Option C: Three-Tier System (Recommended)

Pros: Flexible, accommodates everyone, builds trust gradually
Cons: More complex UI/logic
Effort: 3-4 hours
Cost: $15-20

What to build:

1. Tier 1: Anyone can add shops (community listings)
2. Tier 2: NIP-05 = "Verified Member" badge
3. Tier 3: NIP-39 + NIP-05 = "Verified Owner" badge
4. Different permissions per tier
5. Clear badge display showing verification level

Option D: Just Better Messaging (Quick Fix)

Pros: No code changes, just better UX
Cons: Doesn't solve fake shop problem
Effort: 15 minutes
Cost: $1

What to do:

1. Change messaging from "requires NIP-05" to "recommended"
2. Add disclaimer: "Community-added shops - verify before visiting"
3. Show who added the shop (not necessarily the owner)
4. Add reporting feature for fake listings

---

🎯 MY RECOMMENDATION

Start with Option D ($1, 15 min), then add Option B later when budget allows.

Why?

• Quick fix now, prevents confusion
• Sets realistic expectations
• Can add NIP-39 verification later as enhancement
• Doesn't block current functionality

Implementation:

1. Remove NIP-05 requirement warning for shops
2. Add disclaimer: "Shop listings are community-contributed"
3. Show who added the listing (with their verification level)
4. Add "Are you the owner? Claim this shop" button
5. Make claiming process more robust later with NIP-39

---

💰 BUDGET OPTIONS FOR SHOP VERIFICATION

Option	Effort	Cost	When to Do
A: Keep current	0 min	$0	Now (done)
D: Better messaging	15 min	$1	Now (quick fix)
B: Add NIP-39	2-3 hrs	$10-15	Later (when budget)
C: Three-tier	3-4 hrs	$15-20	Future (comprehensive)

---

❓ WHAT WOULD YOU LIKE?

A) Keep current NIP-05 requirement (simple but weak)
B) Quick messaging fix ($1) - makes it clearer shops are community-added
C) Full NIP-39 implementation ($10-15) - proper shop verification
D) Three-tier system ($15-20) - most flexible and trustworthy
E) Defer to later - focus on launch now, enhance later

My vote: Option B or E (quick fix or defer)

What do you think?