[Ethereum] Managing ERC20 tokens with a multisignature address

erc-20multisignature

Say I have the following:

Address A belongs to me and holds 10 ERC20 tokens, but does not hold any ETH
Address B belongs to somebody else and I need to send 10 ERC20 tokens there from address A
Address C belongs to me and holds 1 ETH. Address A did not approve address C to spend any tokens on its behalf.

Is it possible to transfer these 10 ERC20 tokens from address A to address B by somehow using multiple signatures? What I was hoping for is to initiate a transaction from address C (since it holds ETH to pay for gas) or make address C initiate a transaction on behalf of address A. Or maybe there's a smarter way to transfer ERC20 tokens from an address that never held any ETH?

Thanks!

Best Answer

If A is an external owned account and you want to transfer tokens then you have two options:

Make tokens transfer: you need to pay for the transfer transaction.
Approve a third party for the transfer: you need to pay for the approve transaction.

If A is a contract then it doesn't need to have a non zero balance, since the user executing the contract will be paying for the transaction.

Related Solutions

ERC20 Smart Contract – Understanding Functions and Workflow

There is a long list of questions here which generally makes it hard to answer them. I will start with the basics. The ERC20 Token that you created is stored on the blockchain and you can interact with it by calling different functions like getBalance, sendTransaction.

The way it works is that these tokens are used as a currency for different business models. This is the same concept as nowadays companies offer shares during Initial Public Offering(IPO). Same is the case here. This token is used as a tool to raise money. Companies who want to raise money through this generally publish there whitepapers listing in detail their business model and how they will create value for those who invest in their business

ICO (Initial Coin Offering) is used to distribute this tokens to the investors. For this another contract is written similar to the one used for deploying your ERC20 token, but is much more complex and detailed. This contract is linked to the ERC20 token address. and also contains a price in Ethers for these tokens. Anyone who wants to invest in the business would send Ethers to the ICO Address and would be rewarded tokens accordingly. E.g. 1 Ether = 1000 tokens.

Initially these tokens have zero value in the market. Once the company start their business, these tokens are listed in an crypto-currency exchange. From there tokens get market value.

[Ethereum] Prevent double withdrawal ERC20 API attack

EIP20 refers readers to the MiniMeToken implementation regarding this issue which works around it by adding the line:

require((_amount == 0) || (allowed[msg.sender][_spender] == 0));

EIP20 refers readers to two example token implementations (I've linked to the relevant line numbers):

OpenZeppelin - Brief issue description and link to the original issue comment. Mentions "[o]ne possible solution to mitigate this race condition", but doesn't implement it.
ConsenSys - no mention or attempt to work around the issue

The MiniMeToken function comment says:

This is a modified version of the ERC20 approve function to be a little bit safer

Given this is the reference implementation, I would like to be a lot more confident than "a little bit safer".

There is no backward compatible resolution to this problem, and the solution is still being discussed.

Best Answer

Related Solutions

ERC20 Smart Contract – Understanding Functions and Workflow

[Ethereum] Prevent double withdrawal ERC20 API attack

Related Topic