✨ Ownership detection for ERC721 side about dn404 HOT 11 OPEN

Why not just have an owner() function that returns the owner of the DN404 base contract?

from dn404.

Opensea does not rely on owner or OwnershipTransferred because it’s easily spoofable.

from dn404.

Event easily spoofable for sure, owner is what the contract considers owner.

from dn404.

Proposed solution here:
#43

from dn404.

Event easily spoofable for sure, owner is what the contract considers owner.

Yup, but OpenSea typically doesn't use this to group things under an address's 'created tokens' because that can also be faked. i.e. I can hardcode the owner() to return as you, and have these tokens as 'created by you' if OpenSea trusted the contract return values as the source of provenance.

from dn404.

Well, if I'm the owner of the contract, it makes sense that the items were created by me...

from dn404.

Well, if I'm the owner of the contract, it makes sense that the items were created by me...

Not necessarily. I could create a contract with a fake owner function and inject tokens into your collection. Similar exploit has been used in the past to make fake beeples which is why rarible and opensea moved away from relying on owner.

from dn404.

Yeah @wwhchung is correct here - it's extremely easy to game owner() to make it look like someone else deployed your contract

from dn404.

Why is the owner needed at all? I’ve got a version of ERC404 on my TW3404 repo that uses ERC1155 instead of ERC721 which allows for batch transfers natively.

from dn404.

Why is the owner needed at all?

For marketplaces collection management

from dn404.

Looks like a good solution would be to implement ERC-7015 since Opensea uses this for proof of ownership. (https://docs.opensea.io/docs/contract-level-metadata)

from dn404.