Can a contract that receives a token know the origin of the tokens?
(Assuming the token follows the token standard.)
On transfers, the token standard fires:
event Transfer(address indexed _from, address indexed _to, uint256 _value)
This can allow frontends and user interfaces to listen and show the sender (
_from) of a token.
Since a contract can't listen to events of another contract, a frontend could pass
_from to the contract.
EDIT: For a contract to securely and trustlessly know the
_from of a token, a frontend should pass to the contract a variation of a Merkle state transition proof:
Essentially, it is a proof which make the claim “if you run transaction T on the state with root S, the result will be a state with root S', with log L and output O”
The contract could then verify the proof trustlessly and obtain the
Otherwise, in simply passing
_from instead of a proof, the contract has to trust the frontend, which is insecure for some usecases: for example, a contract that returns tokens to the sender, since an attacker could send a transaction to the contract first and trick the contract into "returning" the tokens to the attacker.