I was wondering if, when using the FA2 library, there is a way to have the contract as a default operator so that users don't have to call update_operators ?

Thank you

1 Answer 1


Yes, you can do this by creating a new transfer policy.

Warning ⚠️ : having the contract be operator by default may introduce a security flaw or be totally fair depending on your contract's logic.

Here how to define a new policy:

import smartpy as sp
FA2 = sp.io.import_script_from_url("https://smartpy.io/templates/fa2_lib.py")

# Inherits from the OwnerOrOperatorTransfer policy
# but you can choose another base policy.
class MyPolicy(FA2.OwnerOrOperatorTransfer):
    # Explicitely change the policy name.
    # This whole method can be remove if you want to keep the base policy name.
    def init_policy(self, contract):
        FA2.OwnerOrOperatorTransfer.init_policy(self, contract)
        self.name = "this-contract-or-owner-or-operator-transfer"

    # Redefine the transaction transfer's permissions.
    def check_tx_transfer_permissions(self, contract, from_, to_, token_id):
            (sp.sender == sp.self_address)
            | (sp.sender == from_)
            | contract.data.operators.contains(
                sp.record(owner=from_, operator=sp.sender, token_id=token_id)

    def is_operator(self, contract, operator_permission):
        # Add self_address to is_operator (used in offchain view)
        return (sp.sender == sp.self_address)
               | contract.data.operators.contains(operator_permission)

Here how you set the policy as a named argument when instanciating your FA2.

c1 = FA2.Fa2<BaseClass>(..., policy=MyPolicy()).

Here is an example.

  • In which cases could it be a security flaw ? Is it alright as long as I make good use of sp.verify ?
    – Synexio
    Commented Oct 27, 2022 at 15:53
  • By itself it's not a security flaw. I simply recommend to check multiple time that your whole contract logic is ok with a by default operator.
    – Jordan_tez
    Commented Oct 29, 2022 at 12:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.