I am looking for some clarifications around FA2 tokens and the notion of operators, as I’m not sure if I get it right or not.

My first question is:
Is it possible to have multiple operators on a tokenID? Indeed, looking at several FA2 smart contracts, I could only see 1 operator per tokenID but the FA2 entrypoint is called “update_operators“ Also, looking at Objkt marketplace, I can see that “Objkt Marketplace” or “Objkt Auctions House” smart contracts are an operator on most (if not all) collections/token.

Does it mean that if these OBJKT smart contracts get hacked, the hacker is able to transfer all NFTs to another destination? If so, is the owner of a token able to remove operators from his token to limit the risks?

Another question that I have:
Assume User1 mints an NFT on Objkt, he becomes the owner of the token User1 put on auction his NFT for 1 day on Objkt, “Objkt Auction” smart contract becomes the operator of the token. During this one day interval, is User1 able to transfer his token to another NFT marketplace (Teia) and sell it there?

If he does so, what will happen at the end of the auction on Objkt? The token wouldn’t be there anymore, is it going to cancel the Auction and reimburse the auction winner?

Sorry for the confusion and thanks for your help!

1 Answer 1

  • Is it possible to have more than 1 operator per tokenID?

Operators are stored in a big-map, there can be as many entries in it as there needs to be. For example here is the contents of the operators bigmap, for the FA2 fungible token "Crunch": https://api.tzkt.io/v1/bigmaps/2810/keys there are hundreds of records in the bigmap.

As well as many wallets setting operators on the same token, the same wallet can set multiple contracts as operators of the token it owns, e.g. TZ1abc123 can allow both KT1def456 and KT1ghi789 to be operators of the token that it owns, at the same time

  • Could a hacker move tokens

When you set an operator, you give permission for another address to access a set amount of your token / NFT. If the owner is compromised, or acts maliciously, then yes it can remove the amount of token you gave it permission too, in a manner you didn't want it too. Its important to always use trusted sources.

  • What happens if the token gets transferred, after a user sets an operator OBJKT

It would still show as listed for sale on OBJKT, as the user gave OBJKT permission to do so. But if you attempted to purchase it you would get an error during the transaction, because TZ1abc123 no longer owns the NFT, so therefore OBJKT can't send it to the purchaser. OBJKT may have some process to routinely check if the tokens are still there, and may remove them. I'm unsure if they do this or not.

This happened a lot with the "Mooncakes" NFT project. Many users listed their NFT's for sale, and then subsequently "burned" the NFT's as part of a challenge. Because OBJKT didn't recognise burned NFTs, all of them remained on sale. When users tried to purchase, they got an error. Mooncakes had to build its own mini-marketplace to filter out OBJKT listings that had been burned, in order to remove the bad entries on OBJKT

  • Many thanks for your answer! This is very detailed and answers my questions! I just have one more question please: I can see that all collections on OBJKT (KT1...) have the OBJKT Minting Factory contract (KT1Aq4wWmVanpQhq4TTfjZXB5AjFpx15iQMM) as administrator. Do we know what kind of access does it have on the tokens itself inside the collections? ie: what if KT1Aq4wWmVanpQhq4TTfjZXB5AjFpx15iQMM gets hacked? Will the hacker be able to transfer all tokens from all collections (since it is the administrator on all collections)? Thanks!
    – Julien
    Commented Aug 22, 2022 at 13:10
  • @Julien you are welcome. If my answer solved your problem, don't forget to upvote + mark as top answer to close the question. This will also help others facing the similar issues. RE: your OBJKT.com question, i'm sorry i've no idea. This is very specific to their application, you will need to ask them directly. Try joining their discord listed on their twitter profile and see if they have a developer support section: twitter.com/objktcom
    – Simon McLoughlin
    Commented Aug 22, 2022 at 13:15
  • No problems, thanks! I have marked as answered but I don't have enough points to upvote
    – Julien
    Commented Aug 22, 2022 at 13:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.