Minting from a button press, and the verification that has to sit behind it

Two Next.js route handlers, api/home and api/mint, with InstaMint and InstaMintFactory ABIs behind them. Where flaskframe was a poll, this is the case where the button has consequences on chain.

That changes the security question entirely. The POST body says which user pressed the button, and without hub verification that claim is unauthenticated. A poll with fake votes is embarrassing; a mint endpoint that believes an unverified claim mints to whoever asks, as often as they ask. Verification is the only thing between this and a free faucet.

The second problem is timing. A frame response is synchronous and a transaction is not, so by the time the second image must be returned the transaction is submitted and unconfirmed. The honest image says submitted, not minted, and showing success on submission is a lie roughly as often as transactions fail.

Someone pays the gas and it is not the person pressing the button, so a relayer is implied, which makes rate limiting a cost question rather than a politeness one.

InstaMintFactory deploys per-collection contracts so each frame mints into its own.