How can we detect if tokens are transferred to our smart contract and avoid "allow"?

Question

Imagine you have a smart contract that accepts all forms of ERC20s. You want users to call a function by which they will send you their ERC20s and in exchange receive a greeting.

Technically we can do that by implementing the famous:

function transferFrom(address from, address to, uint tokens) public returns (bool success);

The problem with transferFrom is that it requires the user to first call

function approve(address spender, uint tokens) public returns (bool success);

How can we avoid the approve part? I can see that someone proposes ERC223 but I'm not sure how that would help and it's unclear. I was thinking at wallets like MetaMask and how they handle token transfers but I think they just call transfer();

Answer 1

This is a limitation of ERC20.

When Alice pays Bob, she sends a transaction to the token contract to make an accounting entry. There is no standard method for the token contract to inform Bob.

The allow/transferFrom flow resolves it with a 2-step process - first authorize Bob to take from Alice, then inform Bob. Since Bob is in the loop, Bob can do what Bob does.

ERC223 is a 1-step solution. Upon receipt of a transfer instruction, check if Bob is a contract. If so, invoke Bob's tokenFallback function so Bob can do whatever Bob does when certain tokens are received.

ERC223 is backward compatible with ERC20.

The receiving contract (store, exchange, service) should implement a tokenFallback() function. It will run when tokens are received. Sender pays for gas.

Hope it helps.

Answer 2

ERC20 as defined here has a function called approveAndCall this allows to make the two steps in a single transaction. The function is:

function approveAndCall(address spender, uint tokens, bytes memory data) public returns (bool success) {
        allowed[msg.sender][spender] = tokens;
        emit Approval(msg.sender, spender, tokens);
        ApproveAndCallFallBack(spender).receiveApproval(msg.sender, tokens, address(this), data);
        return true;
    }

This allows a user to approve a number of tokens and call your contract (spender) in the same transaction. This will allows you to then call transferFrom within the same transaction. Your contract must have implemented a function to receive the call, as shown in the standard ERC20 token:

contract ApproveAndCallFallBack {
    function receiveApproval(address from, uint256 tokens, address token, bytes memory data) public;
}

This means you need to implement your logic inside a function called receiveApproval as described above.

Like this, your token is still ERC20 compatible.

The limitation here is that this function (approveAndCall) is optional, and not all tokens implement it and if you are planning to accept tokens that already exist, you need to verify that they have implemented the function approveAndCall.

Hope this helps.