🛒 NULLCART.NET START YOUR CRYPTO SHOP WITH NULLCART! FREE AND OPEN SOURCE!

[nobswebdev]

I would like to present project that I developed for the community with mission to support crypto economy. NullCart is free and open-source self-hosted crypto shop. Complete privacy-focused, crypto e-commerce solution, with no third parties integrations.

I invite you to host your own shops and to collaborate. I would like this project to be community-driven, and if there is enough interest it could grow into something really interesting.

Once there are enough instances, I would like to create a central site that lists all shops with an advanced rating system - similar to kycnot.me - and a space for the community.

If there is interest, I can add more e-commerce features, more supported cryptocurrencies, or other good ideas from community members.

Website (clearnet): https://nullcart.net/
Website (onion): http://rqk6evooezsbnihccij6ltltagq2myckddxaxmbp3e6wh7hpt2lnrlad.onion/

You can test live demo instance checkout flow with stagenet Monero or testnet4 Bitcoin

Live demo (clearnet): https://demo.nullcart.net/
Live demo (onion): http://3jh2ltksxtsmjidik3st6dawfdcheo2cyv2vth2365af75zdxnwqqsyd.onion/

Source code (clearnet): https://git.nobswebdev.com/nobswebdev/nullcart
Source code (onion): http://4f5t7o2vgo4sdaliwax3isyxzfuxvbvkuwk4smfowutrvx2uneu4egyd.onion/nobswebdev/nullcart

Website features:
- Free and open source
- No JS on the buyer shop
- No buyer accounts
- Non-custodial wallets
- Monero and Bitcoin supported
- No third-party payment processors
- Built-in wallet integration
- Encrypted sensitive data
- Auto order data wipe
- Self-hosted on clearnet and Tor
- SimpleX merchant alerts
- Product catalog with categories, variants, and image galleries
- Shopping cart, checkout, and discount codes
- Auto-deliver digital goods and quote shipping for physical orders
- Order tracking, live payment status, and per-order buyer chat
- Custom branding - your logo, favicon, and shop name
- Prices shown in fiat, paid in crypto with live exchange rates

Current NullCart instances list:
1. Accsnake- ready-made accounts merchant
website (clearnet) https://accsnake.com
website (onion) http://itj7v5hhp6cohgkeuy6ijuxj7f3gak6may6glwx3z27l32lbfxktmtyd.onion/

Donations:
By donating me you support development of free and open source software targeted for privacy/crypto communities. Your name, donation amount and optional comment will be displayed on NullCart main page and later on dedicated page for all my projects (more projects coming). Thank you.

My Monero donation address: 86zpN2bx83rKbhk1WffeHy8qbGYtr6p3sj27fHnJ95XV7hLqmbq9Vix1jo85Fs4JQvZHemPEPq5x6Cb msuQGVrzj6NHsQVb

[LoyceV]

I hope I used correct thread for that.

I think this is the right board, but I don't expect too many readers here. Service Announcements is more serious, but I don't think non-Bitcoin services are allowed there. So you're stuck here.

You can test live demo instance checkout flow with stagenet Monero
Live demo (onion): http://3jh2ltksxtsmjidik3st6dawfdcheo2cyv2vth2365af75zdxnwqqsyd.onion/

I bought some bananas and milk (lol). The site detected confirmation faster than Feather wallet.
I'm surprised to only get the "access token" after paying: if something fails, I might miss it right after I paid. Wouldn't it be better to include the Token in the URL, so I can just bookmark it? I ordered a golden plate just because I'm a Signet whale.  I like how the different orders are listed on top of the site.
How does this work after ordering: am I supposed to use the chat to discuss how to hand over the fruit and dairy?

I noticed the "In stock" amount instantly drops when adding something to a shopping cart. Does that mean someone can "lock" your entire supply for a long term, thereby blocking potential real customers?

[nobswebdev]

Thanks for feedback and live testing. It's a bit of a pity that I can't promote a service associated with a different cryptocurrency.

I just handled your order. I sent your bananas and milk by e-mail Also thanks for buying 999$ golden plate, I was low on stagenet Monero and now I am secured for my future Monero projects

It will be rather hard to miss access token, because once order i created you are "logged in" to order with auth cookie valid 7 days. You would have to clear cookies to lose access to your order which is very unlikely to happen and even if that would happen there is still support path. Site admin can recover access token for you. Order session based on URL token is not too secure. URL token can leak e.g. in referrer header and persists in browser history.

Re order flow. There are 2 types of delivery auto and manual. Auto delivered items appear on order page automatically after checkout is paid sufficient + confirmations threshold is met (tiered, configurable). If order has manually delivered items, you discuss delivery method with admin on chat -> admin sets delivery quote in CMS -> delivery invoice is generated and  displayed to you on order view -> you pay shipping invoice separately from checkout invoice. So it is 2 step payment flow. I decided for that solution because it is simple and very generic solution for delivery quote problem. System for auto quoting delivery cost that works world wide and covers all possible delivery methods would be more complex than this shop itself, so I think my 2 step checkout solution for physical items is best fit here.

Stock displayed on product cards is decreased by quantity you have in cart, but it is only client side display value. There is no stock locking at this step. Stock and discounts are claimed at moment sufficient payment is detected in mempool for checkout invoice to prevent mentioned stock locking abuse.

[LoyceV]

I was low on stagenet Monero and now I am secured for my future Monero projects

They're very easy to mine:

Until now, I had been using Feather wallet for Monero Stagenet testing. But Monero GUI Wallet turns out to be more fun. It took a lot longer than expected to sync, but after that it's very easy to start mining. I quote: "It gives you a 1 in 1 daily chance of finding a block". So instead of scraping dust from faucets, all of a sudden I'm a Monero Stagenet whale If anyone wants a coin, let me know.

PM me an address and I'll send you 100 Monero Stagenet coins. If you want BTC Testnet 4 (which works shitty), add an address for that too.

Stock displayed on product cards is decreased by quantity you have in cart, but it is only client side display value

Sounds like you thought it through

It's a bit of a pity that I can't promote a service associated with a different cryptocurrency.

I'll open a topic in Meta about this.

[NotATether]

This is cool, but I already use BtcPay Server with Monero plugin.

In what ways is your service different?

[nobswebdev]

 

PM me an address and I'll send you 100 Monero Stagenet coins. If you want BTC Testnet 4 (which works shitty), add an address for that too.

Thank you, but I don't need more. Honestly for development you don't need a lot of coins, because you can always set prices to e.g. 0.01$ on products to test payment flow with low amount of coins.

I'll open a topic in Meta about this.

Nice, thank you very much for help.

This is cool, but I already use BtcPay Server with Monero plugin.

In what ways is your service different?

BtcPay is just payment processor. NullCart is complete, privacy focused crypto shop. NullCart is designed for self-hosting and does not depend on any third parties, whether for payments or file uploads. I have big plans for this project, but I need to see interest from the community. If there is interest, I will develop this project by adding more e-commerce features, support for more cryptocurrencies, and any other features that will make sense. I also plan to create a 'NullCart Directory,' which will be a page that lists all instances, has an advanced rating system similar to kycnot.me, and serves as a space for the community.

[decodx]

If there is interest, I will develop this project by adding more e-commerce features, support for more cryptocurrencies, and any other features that will make sense.
<...>

Honestly, if you can expand your project to support Bitcoin right out of the box, I suppose that would be enough to pull it out of the Altcoins board. Moving it over to the main "Service Announcements" or "Project Development" section would give you way better visibility and get a lot more eyes on what you're building.

Nice project, by the way. Good luck!

[nobswebdev]

Honestly, if you can expand your project to support Bitcoin right out of the box, I suppose that would be enough to pull it out of the Altcoins board. Moving it over to the main "Service Announcements" or "Project Development" section would give you way better visibility and get a lot more eyes on what you're building.

Nice project, by the way. Good luck!

Thank you, I just started thinking about adding Bitcoin support. Will post updates on this thread. Ok, I just decided to add Bitcoin support. Work is in progress. Once finished I will ask for moving to main services category. Thank you!

[LoyceV]

Once finished I will ask for moving to main services category.

You can do that yourself (bottom left) when you're ready. Good luck!

[nobswebdev]

I’ve finished adding Bitcoin support to the NullCart store.

Starting today, NullCart store customers can choose between Bitcoin and Monero when paying.

Adding a second supported cryptocurrency also makes it easier to add more cryptocurrencies in the future. If there’s enough interest, adding new ones should be fairly straightforward.

The demo instance has been updated to the latest version:

https://demo.nullcart.net/  
http://3jh2ltksxtsmjidik3st6dawfdcheo2cyv2vth2365af75zdxnwqqsyd.onion/

Bitcoin payments can be tested using Testnet4 coins.

Feedback and live testing are always welcome.

With Bitcoin added, my project should now qualify for the main service announcements category, so I’m moving it there.

Thank you!

[LoyceV]

Feedback and live testing are always welcome.

The current board isn't Service Announcements, but I think this works too.

Suggestion: I'm on a shopping spree, and each time I click "Add to cart", the "Added to cart." popup on top makes my browser go to the top again. Especially on long listings, it's better to keep the page where it was.

I overpaid, and did RBF, to see how it handles that.
Waiting for confirmation now.
Update: it shows both transactions now. That's not how RBF is usually handled, but I guess it could work.

Update2 (after reading the post below this one): one of the transactions is detected as Confirmed, but the order is not updated correctly: "Status: unfulfilled".

[nobswebdev]

The current board isn't Service Announcements, but I think this works too.

Sorry, I am not super familiar with this forum yet. I think this category fits well, but if there is better place for my topic then I am open for suggestions.

Suggestion: I'm on a shopping spree, and each time I click "Add to cart", the "Added to cart." popup on top makes my browser go to the top again. Especially on long listings, it's better to keep the page where it was.

Agreed. This could be nice UX improvement. I will add it to my todos.

I overpaid, and did RBF, to see how it handles that.
Waiting for confirmation now.
Update: it shows both transactions now. That's not how RBF is usually handled, but I guess it could work.

Order won't complete properly and thanks for pointing out this edge case. RBF creates new transaction and payment poller will detect it and update it's confirmations, but replaced transaction is not removed from db and will stay at 0 confirmations forever preventing fulfillment. Currently all invoice transactions must be confirmed for invoice to get paid status. I will fix that soon.

Update1
I fixed RBF edge case bug by pruning replaced txs from db. @Loyce your order should complete properly now. https://git.nobswebdev.com/nobswebdev/nullcart/pulls/5

[LoyceV]

@Loyce your order should complete properly now.

I didn't keep the order open anymore. I'll try again: the RBF-transaction now shows up, and the original transaction disappeared.

I fixed RBF edge case bug by pruning replaced txs from db.

What happens if the original transaction gets confirmed after all? I can't really test that scenario, but it can happen if Nullcart picks up the replacement transaction right before a miner includes the original transaction.

[nobswebdev]

I didn't keep the order open anymore.

I sent you access token on priv.

What happens if the original transaction gets confirmed after all? I can't really test that scenario, but it can happen if Nullcart picks up the replacement transaction right before a miner includes the original transaction.

In this case poller will prefer tx with higher confirmations and will prune ghost tx.

Update1:
I merged mentioned products index page UX improvement. Now scroll position is restored after adding item to cart.

Update2:
I also refactored feedback to be toast like instead of statically rendered on top of the page. Now feedback is visible even when page is scrolled.

[nobswebdev]

AES at rest vs PGP? What encryption model would you implement for NullCart?

Going down the encryption rabbit hole again. Did this before first implementation too, landed on AES because for a shop where the server operator is basically the other party in the chat, it had more pros than PGP. Dumping the thinking here to see what you think.

What we have now

Server-side AES-256-GCM, one key in env. Encrypts order chat, digital delivery stuff, access tokens, captcha cookies. All at rest.

Server decrypts on request. Encrypt at rest, not end to end.

Why I even looked at PGP

It's a privacy-focused shop so I kept asking if server-side AES is enough. Mostly it protects you when someone gets a DB dump/ disk leak but not the key. PGP sounds like the bigger move. Then I actually thought about how a single-operator shop works and it got annoying fast.

AES pros
- dead simple, buyers don't need keys or gpg setup
- stolen DB without env key = useless
- storefront is no-JS (forms + server render). PGP in the browser basically means OpenPGP.js or similar on the buyer side, so you'd need JS. AES lets us keep the shop working in Tor Browser Safest mode where JS is off
- order chat isn't buyer-to-buyer. It's buyer and shop. I'm the operator, I need to read messages to ship, support, fulfill digital goods. E2E doesn't really change that trust model, the shop still ends up with plaintext when I open CMS
- we auto-wipe order data after X days (chat, delivery content, etc). AES fits that fine, because data get wiped anyway

AES cons
- compromised server = game over, key lives in env and app decrypts in memory
- doesn't help if VPS/hosting operator is malicious and has access to the running server

PGP pros
- sounds good on paper for privacy marketing
- actually helps if you don't trust the VPS and shop private key never lives on it
- server could store only PGP ciphertext in DB, plaintext only when someone decrypts locally

PGP cons
- buyer has to encrypt in browser (JS) or use external gpg, most won't
- breaks no-JS / Tor Safest unless you add JS just for order chat
- I still need plaintext in CMS to fulfill orders and reply to buyers, so not real E2E in practice
- normal customers will hate armored blocks, wrong keys, etc
- key rotation is painful, lose or rotate shop key and old chat/delivery content is gone unless you re-encrypt everything

Where I landed

Keeping AES. Not ripping it out for PGP.

In a real E2E messenger the server is untrusted, two users talk through it. Server gets owned, you might still be ok, keys and plaintext never lived there. Buyer device gets owned, E2E doesn't save you, malware reads messages after decrypt.

Here it's buyer talking to shop. I'm the shop and I run the server. Server compromised and AES is done. Not the same threat model, there's no untrusted operator in the middle to design around.

I am curious what would you do, stick with AES, go PGP/E2E, or something else?

Small update unrelated to this post

Since every NullCart instance automatically has its own onion version, I added the onion-location configuration. This means that when NullCart clients are using the clearnet version in the Tor Browser, an “onion site available” button will be displayed.

[nobswebdev]

Announcement: I am starting work on the next NullCart feature- the JS/no-JS switch.

This will allow users to optionally enable features that require JavaScript. When JS is enabled, it will be used only to improve the site’s UX.

Building the site without JavaScript significantly limits our possibilities, which results in a worse UX. On the other hand, it is recommended that transactions requiring a greater degree of privacy be carried out with JS disabled.

Unfortunately, in this case, you cannot have everything at once, but NullCart aims to be a “one-size-fits-all” store, satisfying both customers who require maximum privacy and those whose threat model allows for a somewhat more relaxed approach, enabling them to enjoy a better UX.

[[btc]]

Announcement: I am starting work on the next NullCart feature- the JS/no-JS switch.

This will allow users to optionally enable features that require JavaScript. When JS is enabled, it will be used only to improve the site’s UX.

That's a really good idea, because I really like the minimalistic and lightweight feel of NullCart already, however being able to spruce the display up just a tad, as I feel fit based on my branding and stuff, is fun to think about. Looking forward to the updates.

One of the things I was thinking of, is the ability to add a "private listing"? So for example, I can put an item up for auction (here on the forum, or elsewhere), and when the winner has been decided, I can send them a link to a listing they can only see if they get there through that link. What do you think?

I also want to add to this post, a big thank you for helping me setup my NullCart instance - and recommending a great anonymous VPS to host it through! My project, and it's respective product(s)/shop isn't even nearly finished yet, but I knew I wanted to use it from the moment I read this here ANN. Having it now + getting used to learning/configuring it will help me in the long run.

No problem It is historical moment for NullCart to have first instance

First!

[nobswebdev]

That's a really good idea, because I really like the minimalistic and lightweight feel of NullCart already, however being able to spruce the display up just a tad, as I feel fit based on my branding and stuff, is fun to think about. Looking forward to the updates.

Concept of this js/no-js switch a bit changed mid-work but I think I found a way to make NullCart one-size-fits-all satisfying paranoid as well as standard users. NullCart will use minimum js for UX improvement without breaking functionality with JS disabled. This will also enable me to develop E2E encrypted messenger. I will publish post once update is ready. Regarding further brand customization. If there will be good interest in NullCart I can develop storefront theming. It could work in way shop operator can choose between predefined themes or bring his own theme further customizing shop for his brand.

One of the things I was thinking of, is the ability to add a "private listing"?

Yes, that might be useful and is easy to develop. I put that into backlog.

I also want to add to this post, a big thank you for helping me setup my NullCart instance - and recommending a great anonymous VPS to host it through! My project, and it's respective product(s)/shop isn't fully finished yet, but I knew I wanted to use it from the moment I read this here ANN. Having it now + getting used to learning/configuring it will help me in the long run.

No problem It is historical moment for NullCart to have first instance Take your time, to learn NullCart and let me know when your shop is ready. I would like to list all instances in first post.

Thanks

Update1:
I shipped minimal JavaScript UX improvement and for now the only thing that uses JS is copy button. Copy buttons are displayed next to amount and address on invoice. I think it is most irritating thing when you have to manually select -> copy -> paste addresses and amounts. That's why I decided for it. For users with JavaScript disabled those buttons won't be displayed. For everything else I think native HTML/CSS solutions are good enough.

I also planned to refactor messenger to E2E encrypted with PGP, but I abandoned this idea, because I learned mid-work that it doesn't buy us a lot due to limitations of web. Problem I wanted to solve with E2E messenger is when server gets compromised, attacker won't be able to decrypt chat. But then I realized that someone with access to server could also serve malicious js to the clients that could read keys and decrypt messages. This is problem with integrity that messengers like SimpleX solve by not being web application. I will be honest about this limitation and I recommend to users with the highest OPSEC to use NullCart without JavaScript and move communication with shop into SimpleX. Sorry for zig-zag on this topic. You can read more about web based e2e messengers limitations here https://github.com/simplex-chat/simplex-chat/issues/747

[nobswebdev]

I’m coming to you with another NullCart update.

The next feature I’ve added is a blog.

Why is it worth running a blog when you have an online store? There are a few good reasons:

- It improves SEO.
- It helps attract new customers.
- It builds trust and expertise.
- It allows you to promote products.

Although it is worth doing, running a blog is optional. The blog can be disabled in the CMS.

[nobswebdev]

I’m coming today with a small NullCart update. I added a new section to the promotional website nullcart.net called “Instances.” I will place the current NullCart store instances there. The current list of instances will also be updated in the first post of this thread. I decided to do this because, in the meantime, the first public store, accsnake.com, appeared, dealing with the sale of accounts for online services. I want to focus more on promoting NullCart now, because all the functionalities for the MVP are already ready. Now would be nice to have more instances! If you have any suggestions on how I can effectively advertise NullCart, let me know. Currently, I advertise on Bitcointalk, XMR Bazaar, and Monerica.