The claim system is good enough. If someone gives you a claim code you don't have, tell them to bring it up with Nefario.
How would that work? If Nefario says "I gave that code to Goat". Then what?
If more than one person claims a code, just give it to the first person. It's not your responsibility to figure it out.
And if the person making the second claim says they don't believe that Goat got any other claim, then what? If Nefario gave the same claim code to two people, how can Goat prove that?
If there is a problem with how the claim system was done, it is Nefario's responsibility to reimburse anyone that has a problem that a better system would have solved. Period. If he didn't want this liability on his hands, he would have just done it right in the first place.
Exactly. So as soon as Nefario accepts that liability and agrees to a resolution system, *then* Goat could accept claim codes. But until then, it can't work. (But he won't do that because the liability is massive. See below.)
The ONLY thing you need to check is that the amount of claim codes match the number of shares issued.
That would be the only thing he needed to check if he had an agreement in place with Nefario to resolve disputes. But right now, he'd have to be an idiot to start accepting those claim codes. Consider:
1) Person comes to Goat with a code.
2) Goat redeems the code, it's on the list.
3) Another person comes to Goat with the same code.
4) Goat says, "Sorry. That code was redeemed."
5) Person says, "I didn't redeem it. It was issued to me. Maybe you're lying. Maybe Nefario gave two people the same code. I don't know."
Now what? Nefario has not accepted any liability for this situation and Goat would be a fool to do so since he doesn't trust Nefario. Of course Nefario will say the code was only given to one person and that's likely true. But how can Goat prove he's not scamming? And if you say "in this case, we'll trust Goat", then Goat can cheat anyone he wants to.
In other words, for Goat to accept these codes opens himself up to massive liability if his asset holders try to scam him. And nothing Nefario can do can fix this after the fact. The second Goat starts accepting these codes, this window opens up. Goat would have to be an idiot to start redeeming these codes.
And how can Nefario accept liability for this? He doesn't know if the guy is scamming (redeeming the same code twice) or Goat is scamming (redeeming other people's codes himself through an accomplice). And if Nefario says to the guy, "sorry, I only gave your code to one person", (which is probably true) then the guy can argue that Goat is a scammer. So Goat can only accept codes if Nefario makes good for anyone in this situation, even if they are scamming him.
This code system is so fundamentally broken and so at odds with everything we know about security that it looks like it was thought up in two minutes by a below-average third grader. And, in any event, for Nefario to impose it on Goat and his asset holders without even trying to reach an agreement on a scheme that's at least not so obviously broken is an inexcusable breach of GLBSE's obligation to protect its customers' ownership interests in their assets.