3

ERC-1155 has an API for somebody other to be allowed to transfer somebody's funds.

Is there any "standard" extension of ERC-1155 allowing to limit which tokens and in which amounts can be transferred by this "somebody other"?

Moreover, is there a way to check if this API is or isn't available for a given contract?

2
+50

For the sake of simplicity, we'll call the functionality to limit approves to a specific token and amount "individual approves" since the approvals won't just be a blanket approval over all assets in the contract, but rather to a specific tokenId and amount.

Is there any "standard" extension of ERC-1155 allowing to limit which tokens and in which amounts can be transferred by this "somebody other"?

In general the basic token standards (ERCs 20, 721, and 1155) are made to be extended on. This makes it hard to define what a standard extension would be. OpenZeppelin's contracts are almost certainly the most commonly used templates in the space, and their 1155 suite does not contain functions for individual approves.

Enjin (the authors of the 1155 standard), on the other hand, do: here

Similarly, you could easily extend the OpenZeppelin 1155 to include it.

Moreover, is there a way to check if this API is or isn't available for a given contract?

Since there is no standard specifying these functions (they aren't a part of the 1155 standard, and at least I don't know of an EIP with any traction extending 1155 with individual approvals), there isn't a specific nomenclature specified for functions like these. It would be reasonable to assume that anyone implementing this would use similar wording to ERC20 - approve. That being said, having a function named approve is no guarantee as to what happens in the function, even in a contract that looks like it's ERC20 - the author could put malicious code in there.

As a result, it is strongly recommended to only interact with contracts whose code you can verify, such as on Etherscan or Sourcify. If you'd like, you can read up on the Salmonalla attacks, which were tokens using the ERC20 functions that were rigged to siphon funds from sandwich attackers. A function's name is no guarantee for what's inside of it!

Hope that helps!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.