NFTRanker

Demo

About

NFTRanker turns NFT discovery into a community decision: people compare two NFTs, choose their favorite, and help shape collection rankings. This submission adds a World ID trust layer to that existing product. The key trust moment happens during rapid voting. When someone makes three same-side vote requests within ten seconds, the backend holds the third request before it can count. The interface offers World ID Proof of Human at that moment. People can also choose Not now and complete the existing security check, or close the prompt without counting the held vote. Successful server-validated verification lets the appropriate voting flow continue while preserving normal server restrictions. A guest who creates an account chooses the NFT again, so a pending guest vote is not silently cast under a new identity. World ID also supports email-free NFTRanker accounts, remembered-browser sign-in, and optional connection to an existing account. Newly accepted votes from signed-in, server-confirmed verified accounts receive a World badge and an app-scoped public alias in the voting feed. Proof of Human supplies the assurance needed for this interaction without requiring a passport or disclosing a real-world identity to NFTRanker. There is no one-person-one-vote quota. Verification does not prove every later vote is manual, and it does not remove all anti-bot controls. The goal is to introduce a useful human trust signal at the point where voting behavior warrants an additional check. Scope and status: NFTRanker and its NFT catalog, pairwise voting, rankings, email login, saved NFTs, and voting history predate this work. The new submission is the isolated World ID service, client components, account and voting adapters, migrations, tests, and documented integration patches. It runs in a local integrated preview; the World ID feature is not yet deployed to the public NFTRanker site. A real World App guest proof and upgrade of that verified guest into an NFTRanker account have been confirmed. A fresh account creation, sign-out, and returning-login phone walkthrough remains to be completed.

How it's made

The feature is built as a separate Node.js/Express service with persistent SQLite storage, plus React/TypeScript components and narrow adapters for NFTRanker. IDKit Core and the React widget are pinned to version 4.3.0. Vite builds the client library, and the World widget is loaded when needed. The backend creates and signs verification requests, binds each attempt to its server-derived participant and proof context, and validates the complete response with World before saving verification. Guest and account sign-in flows use World session proofs. Returning login requires a fresh proof of the stored session; a browser locator only finds that binding and is not an authentication credential. Attempts expire, cancellations remain cancelled, and replay and concurrency protections are enforced in storage. The host adapter derives identity from the existing application session, checks active accounts and request origins, and communicates with the feature service through an authenticated internal API. The feature service has its own database and does not open the host database. Explicit host migrations support email-free accounts, while the normal host session continues to authorize profile, saved-NFT, and voting-history access. Rapid-vote protection runs before the original vote handler. The third same-side request is held, and request receipts make an authorized retry idempotent. The alternative security-check path releases a hold only after the host server validates its original challenge. Browser flags, failed checks, and service outages cannot authorize a held vote. Feed attribution is captured from trusted server state at vote acceptance, not from a client-supplied World badge. A disposable integration runner applies the documented patches to copied application source and local data. This allows realistic testing without mounting the prototype into production. The current implementation record reports 96 passing automated tests, feature TypeScript and client builds, and an integrated Vite build. Automated provider responses are mocked; the separately confirmed real guest proof is distinct evidence. Cancellation, unchanged vote counts, mobile layouts, and the alternative-check transition have browser evidence. The main integration lesson was that one-time uniqueness actions cannot serve as repeatable guest verification or returning login. We moved those flows to stored World sessions and fresh proofs. Cross-browser account recovery and a full fresh-phone account lifecycle remain limitations. Codex assisted with implementation, tests, and documentation; the repository includes the prompt and scope history.