0

I'm trying to create a simple react app that will allow the user to enter a token ID and Ethereum address, then it will confirm if that address has it.

Do I need Solidity to do this? I'm aware of OpenZeppelin's OwnerOf function.

0
2

You can do it without Solidity.

I'll assume you need server-side confirmation.

You will need the token contract address and token id. From these, you can get the owner address with a Web3 Javascript API call. The server will need an Ethereum node or API such as Infura to process the request and get the address return value.

Using truffle contracts and after some dependencies and initialization is behind you, the code would look something like:

let tokenContract = await IERC721.at(<tokenContractAddress>);
let owner = await tokenContract.ownerOf(<tokenId>);

Great. Now you know who owns it and you need to authenticate the user to confirm they are the same. You can do that by having the user sign a message with the matching owner account. They will only be able to do that if the address is indeed theirs because they will need to know the private key for the account.

Suppose the message to sign is:

"I own it! Let me in!"

let sig = web3.eth.sign("I own it! Let me in!", <address>);

https://web3js.readthedocs.io/en/v1.3.4/web3-eth.html?highlight=sign%20#sign

Where <address> is one of their accounts, the "from" address, that you probably already collected through the UI. The signature proves the sender knows the private key for the address they are signing with.

Etherscan uses that to confirm "ownership" of deployed contracts by having the deployer sign a message. Generally, MetaMask pops up to approve the signature but it could be another wallet that supports Web3.

You can send the signature to the server through an API, HTTP POST, etc. Great. The signature proves that the owner of the address knows the secret and signed the message. So, if the signer matches the token owner, then the signer owns the token. You just need to confirm that the signer matches the token owner - it wasn't signed by some random account.

let signer = await web3.eth.personal.ecRecover("I own it! Let me in!", signature);

https://web3js.readthedocs.io/en/v1.3.4/web3-eth-personal.html?highlight=ecrecover#ecrecover

Do they match?

ecrecover will return an address - given a message and a signature, what is the signer's address? It's not necessarily the address you want. Ownership of the token is proven if the signer's address matches the address ERC721 is telling you owns the token, so ...

let doesOwn = signer == owner;

Hope it helps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.