2

OpenSea asks approval (that costs gas) to list, sell NFTs you own if for the first time (until their next updates if any) using a contract interaction or function called ApproveForAll(). But what exactly are we signing away when doing this?

"Give permission to access all of your NFT" shown in the MetaMask prompt below sounds dangerous, given the numerous high-profile wallet hacks that have occurred on the Ethereum network this past year through social engineering, especially on Twitter.

enter image description here

In the image, the word "NFT" in blue is a link to the Etherscan page of the collection being approved. In this case, it's the well-known OpenSea Shared Storefront that they're simply calling "NFT", but this blue name could instead be "Bored Ape Yacht Club" if you were trying to approve the BAYC contract.

But the question here is, technically, what exactly are we signing away when we approve a collection contract for listing and trading on OpenSea? Approving "All of your NFT" sounds like anything that we own from a specific collection can just be taken out of our wallet without asking us for a MetaMask signature, even though we came to it only to list a NFT for sale.

Please provide a list of what ApproveForAll() actually encompasses in terms of potential events, versus the specific event (e.g. list the NFT for sale) we might have come to use it for. And is there any situation where the prompt would instead read "Give permission to access all of your funds"?

1 Answer 1

2

But the question here is, technically, what exactly are we signing away when we approve a collection contract for listing and trading on OpenSea? Approving "All of your NFT" sounds like anything that we own from a specific collection can just be taken out of our wallet without asking us for a MetaMask signature, even though we came to it only to list a NFT for sale.

This is exactly it. You're allowing an address (Usually a smart contract, but nothing prevents you from approving a user, which could then transfer your NFTs out of your wallet as it if was theirs) to spend all your tokens from a specific collection.

Please provide a list of what ApproveForAll() actually encompasses in terms of potential events, versus the specific event (e.g. list the NFT for sale) we might have come to use it for.

Well if you're interacting with a smart contract that isnt malicious, and is well designed, the answer is : nothing. Let me explain. While you are actually giving permission to that contract to do literally anything with your tokens, it cannot do anything it hasnt been programmed to do.

Let's take this very simple example contract :

contract TransferNFT {
  
  function makeTransfer(address collection, address to, uint tokenId) public {  
    IERC721(collection).transferFrom(msg.sender, to, tokenId);
  }
}

While, by calling setApprovalForAll(myContractAddress) on an NFT contract (let's say, BAYC), you're allowing my contract to transfer all of your BAYC tokens, to any address, the only situation where it would actually be able to transfer your tokens would be when you're calling makeTransfer(), only from the wallet that holds the tokens, only to the address you specified as input, and only the token you specified. (in the case of OS, it's a bit more complex obviously, they ask you for approval when you list your token so they can transfer it later when the sale is fulfilled, but it's the exact same idea)

In other words, it is perfectly safe. So safe that most dApps asks you to set approval for all of your tokens from a collection eventhough you're trying to list/transfer only one of them instead of asking you for only the one token you want to move, just to avoid asking you again for approval if you want to move more of these tokens with that smart contract in the future.

Now, if you're setting approval to a malicious address, well you just allowed them to transfer all of your tokens on your behalf, so that's what they're usually gonna do. And as soon as they do that, your tokens are gone and you'll never see them again.

And is there any situation where the prompt would instead read "Give permission to access all of your funds"?

Nop, that can't happen. 1 setApprovalForAll transaction = approving all of the tokens from ONE collection, to ONE address only.

ERC20 has a similar mechanism, btw. That's why you have to make an approval transaction when you're swapping tokens on a DEX for the first time, for example.

2
  • have seen access to funds, or maybe it was AproveAll, resulting in wallets being drained of ERC-20s as well though
    – user610620
    Sep 8, 2022 at 1:06
  • When approving the OpenSea Shared Storefront contract for selling NFTs, the pending transaction says "Approve token with no spend limit". I don't recall being asked for a custom spend limit when approving the contract interaction. Is this bad and should the tx be cancelled?
    – user610620
    Sep 10, 2022 at 10:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.