dn404
dn404 copied to clipboard
Vectorized
✨ Ownership detection for ERC721 side
For marketplaces like Opensea
-
Upon initialization handshake, the mirror will try to get the owner from the base contract. If there is an owner, the owner will be updated to that owner, and a
OwnershipTransferred(address indexed oldOwner, address indexed newOwner)event will be emitted. Store the current owner in the deployer slot. -
Upon logging a batch NFT mint / burn, try to get the owner from the base contract. If the owner is different from that of the deployer slot, a
OwnershipTransferred(address indexed oldOwner, address indexed newOwner)will be emitted, and the owner in the deployer slot will be updated.
Not sure if this will work, someone help me try.
Why not just have an owner() function that returns the owner of the DN404 base contract?
Opensea does not rely on owner or OwnershipTransferred because it’s easily spoofable.
Event easily spoofable for sure, owner is what the contract considers owner.
Event easily spoofable for sure, owner is what the contract considers owner.
Yup, but OpenSea typically doesn't use this to group things under an address's 'created tokens' because that can also be faked. i.e. I can hardcode the owner() to return as you, and have these tokens as 'created by you' if OpenSea trusted the contract return values as the source of provenance.
Well, if I'm the owner of the contract, it makes sense that the items were created by me...
Well, if I'm the owner of the contract, it makes sense that the items were created by me...
Not necessarily. I could create a contract with a fake owner function and inject tokens into your collection. Similar exploit has been used in the past to make fake beeples which is why rarible and opensea moved away from relying on owner.
Yeah @wwhchung is correct here - it's extremely easy to game owner() to make it look like someone else deployed your contract
Why is the owner needed at all? I’ve got a version of ERC404 on my TW3404 repo that uses ERC1155 instead of ERC721 which allows for batch transfers natively.
Why is the owner needed at all?
For marketplaces collection management
Looks like a good solution would be to implement ERC-7015 since Opensea uses this for proof of ownership. (https://docs.opensea.io/docs/contract-level-metadata)
