ERC-223 tokens (e.g. DEAPCOIN) become untransferable after EIP-7702 delegation due to missing tokenFallback

Open
#180 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
58/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Quiet
Tech stack
solidity
Domain
blockchain

Research direction

Start by inspecting EIP7702StatelessDeleGator and its existing IERC721Receiver and IERC1155Receiver implementations, then reproduce the failure with DEAPCOIN. Trace how an ERC-223 transfer handles the delegated address and verify completion by confirming transfers to and from the delegated address no longer revert.

Written by the indexing model from the issue text.

Description

Description

After an EOA delegates to EIP7702StatelessDeleGator, ERC-223 token transfers to/from the delegated address revert. This is because the delegator implements IERC721Receiver and IERC1155Receiver but does not implement the ERC-223 tokenFallback(address, uint256, bytes) callback.

Root Cause

EIP-7702 delegation sets 23 bytes of bytecode (the delegation designator 0xef0100 || address) on the EOA. This causes EXTCODESIZE to return 23 instead of 0.

Many ERC-223 tokens use extcodesize to determine whether the recipient is a contract:

// Example from DEAPCOIN (0x1a3496c18d558bd9c6c8f609e1b129f67ab08163)
// Compiled with Solidity 0.4.25
bool isUserAddress;
assembly { isUserAddress := iszero(extcodesize(_to)) }

When extcodesize returns non-zero, the token contract treats the delegated EOA as a contract and either:

  1. Calls tokenFallback() / tokenReceived() on the recipient → reverts because the delegator does not implement this interface
  2. Rejects the transfer outright (e.g. "try to send token to contract" in batch transfer paths)

Impact

  • Users who enable smart account features on MetaMask lose the ability to send or receive ERC-223 tokens
  • Tokens already held in the wallet before delegation become effectively locked
  • The user cannot easily undo this — revoking delegation requires another EIP-7702 transaction, and many users may not realize the delegation caused the issue
  • DEAPCOIN (DEP) is one confirmed affected token, but any ERC-223 token with extcodesize-based contract detection is affected

Steps to Reproduce

  1. Delegate an EOA to EIP7702StatelessDeleGator (0x63c0c19a282a1B52b07dD5a65b58948A07DAE32B)
  2. Attempt to transfer DEAPCOIN (DEP, 0x1a3496c18d558bd9c6c8f609e1b129f67ab08163) from or to the delegated address
  3. Transaction reverts
Dominant language
Solidity
Stars
226
Forks
119
Avg merge
1h 51m
Merged PRs (30d)
1

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from MetaMask/delegation-framework

All issues in MetaMask/delegation-framework

Similar issues

More Blockchain issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.