MetaMask / MetaMask/metamask-extension
Enable users to revoke allowances in their activity history
- Dominant language
- TypeScript
- Stars
- 13.2k
- Forks
- 5.6k
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 451
Description
## Background
For a very long time we have been wanting to empower users to review and revoke the permissions they have given (see https://github.com/MetaMask/metamask-extension/issues/8174 and https://github.com/MetaMask/metamask-extension/issues/10331 as examples). We haven't got to this yet, but there's a small scope, low hanging fruit work that we can do in the mean time.
Recently, a phishing victim realized while they were being drained, and to save their money the time to revoke was critical. If that user had an easy access revoke option in their recent approve transactions that would increase their chance of revoking the allowance in time. This is the win we're trying to achieve with this issue. It won't be something that will work for everyone and in all situations, but for some users it might be just enough.
## Design file
[Figma link](https://www.figma.com/file/GkgKQeBO7qDgPs2Jqd8pmd/Manage-Token-Allowance?node-id=802%3A1040&t=cJ3g0dqprJKWZhOS-1) (WIP)
## Requirements and things to consider
1. This should be implemented for ERC20 approve, ERC721 approve, ERC721 setApprovalForAll, ERC1155 approve and ERC1155 setApprovalForAll.
2. For each of those allowances in the transaction history, we should check wether it was indeed _giving allowance_ or if it was a _revoking allowance_ (see section below).
2.a. If it was _giving allowance_, we'll display a revoke button (per design above) in that activity history line.
2.b. If it was _revoking allowance_, we won't display any button.
3. If a user clicks on the revoke button and submits the revoke transaction, we'll hide (? TBD) that button. It's also TBD wether we also want to hide it If a user revokes that allowance elsewhere. How much additional effort this would add to scope? Let's discuss this.
## What _giving allowance_ and _revoking allowance_ look like for each method and contract
Note: for all below, spenderAddress is the address that is receiving or has received the allowance.
- ERC20 approve
giving allowance: `approve(spenderAddress, amount)`
revoking allowance: `approve(spenderAddress, 0)` - you revoke by setting the amount to 0 for that specific spenderAddress.
- ERC721 & ERC1155 approve
giving allowance: `approve(spenderAddress, tokenId)`
revoking allowance: `approve(zeroAddress, tokenId)` - you revoke by setting a new spender, like the burner address. There can always only be a single spender using this method.
- ERC721 & ERC1155 setApprovalForAll
giving allowance: `setApprovalForAll(spenderAddress, true)`
revoking allowance: `setApprovalForAll((spenderAddress, false)` - you revoke by setting the approved(bool) parameter to false.
## Reference
- [ERC20 docs](https://docs.openzeppelin.com/contracts/4.x/erc20)
- [ERC721 docs](https://docs.openzeppelin.com/contracts/2.x/api/token/erc721)
- [ERC1155 docs](https://docs.openzeppelin.com/contracts/3.x/erc1155#:~:text=ERC1155%20is%20a%20novel%20token,their%20guides%20before%20moving%20on.)
- [A ERC20 contract on Etherscan](https://etherscan.io/address/0x1f9840a85d5af5bf1d1762f925bdaddc4201f984#writeContract)
- [A ERC721 contract on Etherscan](https://etherscan.io/address/0xbc4ca0eda7647a8ab7c2061c2e118a18a936f13d#writeContract)
- [A ERC1155 contract on Etherscan](https://etherscan.io/address/0x2a187453064356c898cae034eaed119e1663acb8#writeContract)
## Screenshot of new design

Contributor guide
Research direction
No files, tests, or entry points are named. Start by locating the transaction-history activity entries and reviewing the linked WIP Figma design; done means distinguishing giving from revoking ERC20, ERC721, and ERC1155 allowances and offering the specified revoke action where appropriate.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- blockchain, frontend
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100