ERC-7246: Encumber - Splitting Ownership & Guarantees

Abstract

This ERC proposes an extension to the ERC-20 token standard by adding Encumber—the ability for an account to grant another account exclusive right to move some portion of their balance. Encumber is a stronger version of ERC-20 allowances. While ERC-20 approve grants another account the permission to transfer a specified token amount, encumber grants the same permission while ensuring that the tokens will be available when needed.

Motivation

This extension adds flexibility to the ERC-20 token standard and caters to use cases where token locking is required, but it is preferential to maintain actual ownership of tokens. This interface can also be adapted to other token standards, such as ERC-721, in a straightforward manner

Token holders commonly transfer their tokens to smart contracts which will return the tokens under specific conditions. In some cases, smart contracts do not actually need to hold the tokens, but need to guarantee they will be available if necessary. Since allowances do not provide a strong enough guarantee, the only way to do guarantee token availability presently is to transfer the token to the smart contract. Locking tokens without moving them gives more clear indication of the rights and ownership of the tokens. This allows for airdrops and other ancillary benefits of ownership to reach the true owner. It also adds another layer of safety, where draining a pool of ERC-20 tokens can be done in a single transfer, iterating accounts to transfer encumbered tokens would be significantly more prohibitive in gas usage.

Specification

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 and RFC 8174.

A compliant token MUST implement the following interface

Rationale

The specification was designed to complement and mirror the ERC-20 specification to ease adoption and understanding. The specification is intentionally minimally proscriptive of this joining, where the only true requirement is that an owner cannot transfer encumbered tokens. However, the example implementation includes some decisions about where to connect with ERC-20 functions worth noting. It was designed for minimal invasiveness of standard ERC-20 definitions. - The example has a dependency on approve to facilitate encumberFrom. This proposal allows for an implementer to define another mechanism, such as an approveEncumber which would mirror ERC-20 allowances, if desired. - transferFrom(src, dst, amount) is written to first reduce the encumbrances(src, amount), and then subsequently spend from allowance(src, msg.sender). Alternatively, transferFrom could be implemented to spend from allowance simultaneously to spending encumbrances. This would require approve to check that the approved balance does not decrease beneath the amount required by encumbered balances, and also make creating the approval a prerequisite to calling encumber.

It is possible to stretch the Encumber interface to cover ERC-721 tokens by using the tokenId in place of amount param since they are both uint. The interface opts for clarity with the most likely use case (ERC-20), even if it is compatible with other formats.

Backwards Compatibility

This EIP is backwards compatible with the existing ERC-20 standard. Implementations must add the functionality to block transfer of tokens that are encumbered to another account.

Reference Implementation

This can be implemented as an extension of any base ERC-20 contract by modifying the transfer function to block the transfer of encumbered tokens and to release encumbrances when spent via transferFrom.

Security Considerations

Parties relying on balanceOf to determine the amount of tokens available for transfer should instead rely on balanceOf(account) - encumberedBalance(account), or, if implemented, availableBalanceOf(account).

The property that encumbered balances are always backed by a token balance can be accomplished in a straightforward manner by altering transfer and transferFrom to block . If there are other functions that can alter user balances, such as a rebasing token or an admin burn function, additional guards must be added by the implementer to likewise ensure those functions prevent reducing balanceOf(account) below encumberedBalanceOf(account) for any given account.

Copyright

Copyright and related rights waived via CC0.