Conversation
📝 WalkthroughWalkthrough
Changes
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In `@whitelist.yaml`:
- Around line 34-35: The YAML currently adds risky entries 'url: nftstudio.art'
and 'url: "*.nftstudio.art"' to the wallet whitelist; remove both entries (or at
minimum remove the wildcard) and do not merge until the operator is
independently verified: attach WHOIS/ownership proof, verifiable
operator/company details, third-party reviews, and a contract/wallet-integration
security audit; if a subdomain must be whitelisted, replace the wildcard with
the exact host(s) (e.g., specific.api.nftstudio.art) and include justification
in the PR description alongside the verification artifacts.
whitelist.yaml
Outdated
| - url: nftstudio.art | ||
| - url: "*.nftstudio.art" No newline at end of file |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Check domain registration details via WHOIS
echo "=== WHOIS lookup for nftstudio.art ==="
whois nftstudio.art 2>/dev/null | head -30
# Check if domain resolves and get basic info
echo ""
echo "=== DNS resolution check ==="
dig +short nftstudio.art A 2>/dev/null
dig +short nftstudio.art CNAME 2>/dev/null
dig +short nftstudio.art MX 2>/dev/null
# Check HTTP response
echo ""
echo "=== HTTP response check ==="
curl -sI -w "HTTP Status: %{http_code}\nFinal URL: %{url_effective}\n" -L "https://nftstudio.art" --max-time 10 --connect-timeout 5 2>&1 | head -20Repository: phantom/blocklist
Length of output: 907
🌐 Web query:
nftstudio.art scam phishing legitimate NFT platform
💡 Result:
I can’t verify nftstudio.art as a well-known, reputable NFT marketplace from credible third‑party sources. Based on what I can confirm, you should treat it as high risk unless you can independently prove it’s operated by a real, accountable company.
What I found that’s relevant:
- Law enforcement has documented a common scam pattern where bogus NFT “marketplaces” target artists, claim the artist has earnings, then demand fees to withdraw, and sometimes try to get victims to enter a wallet seed phrase (which enables draining the wallet). This is exactly the kind of setup many “new NFT platforms” use. [1]
- General NFT scam writeups also highlight phishing/sleepminting and other tactics that rely on impersonation, fake listings, and social engineering, often via links to unfamiliar sites. [2]
Practical safety checklist (use before doing anything on nftstudio.art):
- Do not enter your seed phrase anywhere (ever). If a site asks for it, it’s a scam. [1]
- Do not pay any “activation/minting/validation/withdrawal” fee to receive proceeds—this is a classic advance-fee scam pattern. [1]
- If you must test, use a burner wallet with no funds and no approvals on your main wallet.
- Look for strong legitimacy signals: real company name, jurisdiction, verifiable team, external reputation, and independent coverage/reviews (not just testimonials on the site). If these are missing, walk away.
If you paste the message/email/DM you received (or describe what the site is asking you to do—connect wallet, pay a fee, sign a transaction, etc.), I can help you assess the specific scam indicators.
Sources:
[1] Brooklyn District Attorney press release on seized scam NFT marketplace domains and warning signs (fees to access earnings; seed phrase theft).
[2] Finder.com overview of common NFT scams and how to avoid them.
Do not whitelist nftstudio.art without independent verification of legitimacy.
Adding domains to a crypto wallet whitelist is security-critical. Verification reveals serious concerns:
- WHOIS registration data unavailable — domain registration details are hidden or inaccessible, preventing verification of ownership and age. This is a common tactic for short-lived phishing/scam domains.
- Cannot independently verify legitimacy — no credible third-party sources confirm nftstudio.art as a legitimate NFT platform. It matches common NFT marketplace scam patterns documented by law enforcement (fees to access earnings, seed phrase theft attempts).
- Wildcard subdomain risk —
*.nftstudio.arttrusts all subdomains with the same security level. If the domain or its operator is compromised, all subdomains become attack vectors.
The domain does serve active content (HTTP 200) behind Cloudflare, but this alone does not establish legitimacy. Before merging, require:
- Independent verification of the operator (verifiable company name, jurisdiction, team, external reviews)
- Domain age and ownership records (WHOIS or official registration proof)
- Security audit of the platform's contract interactions and wallet integration
- Removal of wildcard entry — whitelist only specific subdomains that are actively used
🤖 Prompt for AI Agents
In `@whitelist.yaml` around lines 34 - 35, The YAML currently adds risky entries
'url: nftstudio.art' and 'url: "*.nftstudio.art"' to the wallet whitelist;
remove both entries (or at minimum remove the wildcard) and do not merge until
the operator is independently verified: attach WHOIS/ownership proof, verifiable
operator/company details, third-party reviews, and a contract/wallet-integration
security audit; if a subdomain must be whitelisted, replace the wildcard with
the exact host(s) (e.g., specific.api.nftstudio.art) and include justification
in the PR description alongside the verification artifacts.
## Domain Ownership Verification DNS TXT record proves ownership: dig TXT _phantom-verify.nftstudio.art +short Returns: "timastras9-verified-2026" ## Platform Details - Name: NFT Studio - URL: https://nftstudio.art - Function: AI-powered NFT art generation and minting on Solana - Twitter: https://x.com/nftstudio517 - GitHub (owner): https://github.com/timastras9 ## Technical Stack - Frontend: React + Vite hosted on Cloudflare Pages - Blockchain: Solana mainnet - NFT Standard: Metaplex Token Metadata Program - Wallet Integration: Phantom, Solflare via @solana/wallet-adapter - No custom smart contracts - uses standard Metaplex instructions only ## Security Notes - Removed wildcard entry per security recommendation - Only exact match nftstudio.art whitelisted - All transactions are standard Metaplex mint operations ## Changes - Added: nftstudio.art (exact match only)
timastras9
force-pushed
the
add-nftstudio-art
branch
from
425c631 to
a72ec2f
Compare
Verification UpdatesI've addressed all the concerns raised: 1. Domain Ownership Proof ✅Added DNS TXT record for verification: dig TXT _phantom-verify.nftstudio.art +short
"timastras9-verified-2026"2. Removed Wildcard ✅Changed from 3. Independent Verification ✅
4. Technical Details
5. Transaction PatternAll transactions are standard NFT mints:
The platform allows users to generate AI art and mint it as NFTs on Solana mainnet. No fees are collected before minting, no seed phrases requested. Happy to provide any additional verification needed. |
Update: Live DeploymentThe platform is live and deployed at https://nftstudio.art Verification Summary
Transaction Safety
Happy to provide any additional information needed for approval. |
1 participant
dApp Information
What it does
Technical Details
Verification
Changes
Added to whitelist.yaml:
nftstudio.art*.nftstudio.artSummary by CodeRabbit