Problem with setApprovalForAll( )

Question

I was just scrutinizing the source code of an NFT marketplace. within the createNFT( ) function of their smart contract, I witnessed there is a setApprovalForAll(_marketplaceAddress) right after the _mint(msg.sender, _tokenId).

I perceive from this that even by minting a single ERC721 token, you are allowing the marketplace contract to have authority over all of your ERC721 tokens minted on that specific smart contact.

So my question is why they have not used approve() (Not sure if it's the right approach), which is meant to approve the marketplace for just a single token rather than all of the tokens of the msg.sender?

Thanks in advance

Is there a particular reason for such a approach?

Answer 1

The SetApprovalForAll() function is supposed to take two arguments, to and approved. When a user calls SetApprovalForAll(_marketplaceAddress, true) in the smart contract, the user gives permission to the marketplace to trade any of his NFTs minted using that contract.

I believe that SetApprovalForAll() is used because it's assumed you trust the given operator (the marketplace) and allows the transferring of your NFTs at a future date. This is important in the operation of decentralized marketplaces. Ultimately, there is a balance between trusting the marketplace to perform operations for you to transfer all the tokens minted from a specific contract (using setApprovalForAll()) and the need for the marketplace to have approval to transfer a specific token with a tokenId (using approve()).

See:

https://stackoverflow.com/questions/69854414/why-and-when-is-setapprovalforall-called