Selling a Name Without Handing Over the Keys: DEXignation’s On-Chain Marketplace

When you list a domain name for sale on most platforms, you hand custody to an escrow or grant a marketplace sweeping permission over your entire wallet. We wanted something different for .dex names: a way to put a name up for sale where the name never leaves your wallet until someone actually pays for it, and where the marketplace can never touch anything except the one name you chose to sell.

This post walks through how the DEXignation marketplace works and the decisions behind it.

The shape of the problem

A .dex name is an ERC-721 NFT issued by our registrar. Selling one should feel obvious: set a price, and when a buyer pays it, the name is theirs. But the obvious version hides three traps.

The first is custody. If listing a name means transferring it into a marketplace contract, the seller has to trust that contract to hold their asset and give it back on cancel. That is a lot of trust for the simple act of advertising a price.

The second is approval scope. The common shortcut is to grant setApprovalForAll, letting the marketplace move any of your NFTs. It is convenient and it is exactly how a compromised marketplace drains wallets.

The third is settlement. If payment and transfer are two separate steps, there is always a window where one happened and the other did not — the buyer paid but the name did not move, or vice versa.

Our answer: approval, not custody

The marketplace is a separate contract from the registrar, and it never holds names. To list, a seller does two things: approve the marketplace for that single token, then call list with a price denominated in a stablecoin. The name stays in the seller’s wallet the entire time it is listed. The approval is the only thing the seller grants, and it is scoped to exactly one token — not the whole collection.

When a buyer comes along, they approve the stablecoin and call buy. Inside that one transaction, the contract pulls the buyer’s USDC, pays the seller, transfers the name to the buyer, and closes the listing. If any part fails, all of it reverts. There is no window. A buyer cannot pay without receiving the name, and a seller cannot lose the name without being paid.

Because the price is set directly in a stablecoin’s units, there is no currency conversion and therefore no price oracle. That removes an entire category of failure — the stale or manipulated price feed — that has caused real losses elsewhere.

Why the marketplace is its own contract

It would have been simpler, in one sense, to bolt the selling logic onto the name contract itself. We deliberately did not. Trading logic — fees, pricing rules, the mechanics of a purchase — evolves. The names themselves are the asset and should be stable. Keeping them in separate contracts means we can improve or replace the marketplace without ever redeploying the contract that holds everyone’s names. If a bug surfaces in trading, the names are untouched. This is the same separation that established naming and trading systems converged on, and for the same reason.

Subnames come along for the ride

A .dex name can have subnames — think pay.roy.dex under roy.dex. A subtle question follows: when someone sells roy.dex, what happens to everything beneath it?

In our design, subnames are records owned hierarchically by the parent, not independent tokens. So when the parent name transfers to a buyer, control of the whole subtree moves with it automatically. Buying roy.dex means buying everything under roy.dex. The buyer receives a complete tree, which is exactly what makes a whole-name sale safe — nobody is left holding a fragment that someone else can later pull out from under them.

We support whole-name trades and only whole-name trades, precisely to avoid the one unsafe configuration: selling a subname away from its parent, where a later sale of the parent could strip the subname’s new owner. By keeping the marketplace to whole names, that risk simply does not exist.

A quieter way to show “for sale”

Each .dex name renders as a hexagonal card, drawn entirely on-chain, with a color that reflects how long the name is secured for. We wanted listed names to signal their status without shouting it. So while a name is listed, its card shows a small, restrained LISTED label in mint green near the bottom — no banner, no price stamped across the art, nothing covering the name.

What makes this work cleanly is that the card asks the marketplace, at the moment it is rendered, whether the name is currently listed. The seller does not perform any extra step to make the mark appear or disappear; listing and cancelling are the only actions, and the card reflects reality on its own. The lookup is defensive: if the marketplace were ever paused or replaced, the card still renders — just without the mark — so a name’s artwork can never be broken by the trading layer.

What we verified

The behavior described here is not aspirational; it is covered by an integration test suite that exercises the full path: register a name, list it, confirm the card shows the mark, have a fresh address pay in stablecoin and receive the name, confirm the funds split correctly and the mark clears, and confirm that a subname follows its parent to the buyer. The suite also pins down the guards — a listing whose seller has since moved the name cannot be bought, only the owner can list, only the seller can cancel, the protocol fee is capped, and payment runs through battle-tested safe-transfer logic.

Where this fits

A name is more useful when it can change hands safely. The marketplace is the piece that lets .dex names move between people without custody risk, without over-broad permissions, and without the settlement gaps that make secondary trading nerve-wracking. It is intentionally small — listing, price updates, cancellation, and atomic purchase — because a small, auditable surface is the right foundation for something that handles other people’s assets.

The name stays yours until someone pays for it. Then, in a single step, it is theirs. That is the whole idea.

— -

DEXignation is a naming service issuing .dex names as on-chain NFTs with programmable, fully on-chain artwork. This post describes the fixed-price marketplace for secondary sales.