Working with FA1.2 and FA2 token, i see that for FA1.2, when a transaction is done by the user, you need to call approve, with an amount, and for FA2, it is update_operators who is called, but without amount. So, the smart contract can easily overspend with a FA2 token (not with FA1.2).

I find that dangerous and a real weakness for the FA2 standard. I'm wrong somewhere and the 2 methods are equals in safety or the update_operators method with no amount for calling smart contract is a real danger ?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.