How is an asset verified?

Question

I have created a Stellar asset by following the steps in Custom Assets. I can successfully trade the asset on StellarPort.io even though it is not "verified". However, the asset does not even appear on several other exchanges. I can find no documentation that specifically explains how to verify an asset. CORS appears to be enabled for my stellar.toml file.

I notice that more than half of the assets listed on StellarPort are not verified. I compared many of their stellar.toml files and have not yet discovered a difference between those of verified vs. non-verified assets, relevant to verification. I checked these files because the warning message on non-verified assets is "This asset has NOT been verified by vcbear.net", for example, indicating that it is my server which is supposed to verify the asset, which I guess somehow depends on stellar.toml. In some cases, non-verification may be due to the absence of the asset in the stellar.toml file, but there are other cases for which the asset is present even when non-verified, including my own case.

Answer 1

I am one of the devs at Stellarport. The verified status means (like you are alluding to) that the domain has verified that it has indeed issued this asset.

For example, any stellar account can issue a MOBI asset and add mobius.network as its home domain. How should you (the user) differentiate between the real MOBI and a fake MOBI?

Enter verification - verification basically uses a defined protocol here: https://www.stellar.org/developers/guides/concepts/stellar-toml.html

Stellarport the client application goes out to the home domain and gets the stellar.toml file there. It checks the stellar.toml for a currency that has the code and issuer combination of the asset in question. If such a combination exists in the stellar.toml, then the asset is considered "verified".

Assets can be unverified for a bunch of reasons:

1. No home domain on the issuing account
2. No stellar.toml at the home domain
3. stellar.toml cannot be read by the client application because it is not available at https or because it is missing Access-Control-Allow-Origin: * http header on the stellar.toml response.
4. The stellar.toml is malformed (i.e. does not conform to toml spec)
5. No matching code/issuer combination in the stellar.toml

Hope that clears it up. cheers.