Say I have an ERC721 contract A deployed and all tokens are minted to max supply. Now I want to write an ERC20 contract B that has some methods that require only owners of tokens in contract A can call.

I'm thinking having an address property of contract A in contract B, then call ERC20(contractAAddress).balanceOf(sender) which should returns non zero if the sender address owns any token in contract A. Is there any issue or security concern with this approach where sender can somehow bypass the require check?

Also, how can I check if a sender to a method in contract B has which tokenId of contract A? There is an ownerOf(address) method but it will require looping through all the token supply to find out on each call. Is there a more efficient way?


  • In OpenZeppelin implementation there's ownerOf(tokenId) and it is accessing a mapping to retrieve the owner address which should be fairly cheap.
    – Ismael
    Commented Oct 28, 2021 at 0:08

1 Answer 1


For the first question you can use modifier like that:

    modifier onlyTokenOwner() {
        require(A.balanceOf(msg.sender) > 0, "You must own a token");

For the second question if the ERC721 confirm to the interface of IERC721Enumerable you can easily check it else a workaround to it would be to make the user send you the tokenID they claim to have and then to check if he realy have it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.