We are coding a contract that will work with ERC721 tokens, basically a Plasma Root Chain contract. We need this contract to do some work whenever it receives a new ERC721 token from a SafeTransferFrom.

Just like the function() external payable function is called only when ether is transferred to the contract, we would need the same functionality for ERC721, but we are not sure if it exists or is even possible to implement.

We know the function onERC721Received(address operator, address from, uint256 tokenId, bytes memory data) internal returns (bytes4) is called whenever a SafeTransferFrom is done correctly, however, what can be done to stop anyone from just calling that function without actually depositing an ERC721 token?

2 Answers 2


If it is a genuine ERC-721 transfer transaction, then the msg.sender of the transaction will be the address of the ERC-721 contract. This transaction also contains data about which tokenId was just transferred to you. So you can call ownerOf(tokenId) on that contract, and if the address returned is your contract's address, then you can be confident that you just received an ERC721 token.


Typically what most people are not actually doing in practice is they are whitelisting the token contracts they want to support.


  • OpenSea only shows tokens that are pre-registered
  • Compound only allows trades in tokens that have been vetted

Honestly I was expecting it to be more decentralized and default-allowed for dealing with any contract following standards and responding to the introspection.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.