ERC-223 tokens (e.g. DEAPCOIN) become untransferable after EIP-7702 delegation due to missing tokenFallback
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 58/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Quiet
- Tech stack
- solidity
- Domain
- blockchain
Research direction
Start by inspecting EIP7702StatelessDeleGator and its existing IERC721Receiver and IERC1155Receiver implementations, then reproduce the failure with DEAPCOIN. Trace how an ERC-223 transfer handles the delegated address and verify completion by confirming transfers to and from the delegated address no longer revert.
Written by the indexing model from the issue text.
Description
Description
After an EOA delegates to EIP7702StatelessDeleGator, ERC-223 token transfers to/from the delegated address revert. This is because the delegator implements IERC721Receiver and IERC1155Receiver but does not implement the ERC-223 tokenFallback(address, uint256, bytes) callback.
Root Cause
EIP-7702 delegation sets 23 bytes of bytecode (the delegation designator 0xef0100 || address) on the EOA. This causes EXTCODESIZE to return 23 instead of 0.
Many ERC-223 tokens use extcodesize to determine whether the recipient is a contract:
// Example from DEAPCOIN (0x1a3496c18d558bd9c6c8f609e1b129f67ab08163)
// Compiled with Solidity 0.4.25
bool isUserAddress;
assembly { isUserAddress := iszero(extcodesize(_to)) }
When extcodesize returns non-zero, the token contract treats the delegated EOA as a contract and either:
- Calls
tokenFallback()/tokenReceived()on the recipient → reverts because the delegator does not implement this interface - Rejects the transfer outright (e.g.
"try to send token to contract"in batch transfer paths)
Impact
- Users who enable smart account features on MetaMask lose the ability to send or receive ERC-223 tokens
- Tokens already held in the wallet before delegation become effectively locked
- The user cannot easily undo this — revoking delegation requires another EIP-7702 transaction, and many users may not realize the delegation caused the issue
- DEAPCOIN (DEP) is one confirmed affected token, but any ERC-223 token with
extcodesize-based contract detection is affected
Steps to Reproduce
- Delegate an EOA to
EIP7702StatelessDeleGator(0x63c0c19a282a1B52b07dD5a65b58948A07DAE32B) - Attempt to transfer DEAPCOIN (DEP,
0x1a3496c18d558bd9c6c8f609e1b129f67ab08163) from or to the delegated address - Transaction reverts
- Dominant language
- Solidity
- Stars
- 226
- Forks
- 119
- Avg merge
- 1h 51m
- Merged PRs (30d)
- 1
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from MetaMask/delegation-framework
-
Difficulty 3/5 1-2 days Newbie friendliness 74/100
MetaMask/delegation-framework#198 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 45/100
MetaMask/delegation-framework#192 · 1 comment ·
-
UKZToken.sol Open
Difficulty 5/5 Over a week Newbie friendliness 15/100
MetaMask/delegation-framework#185 ·
-
UKZ Open
Difficulty 5/5 Over a week Newbie friendliness 10/100
MetaMask/delegation-framework#184 ·
-
UTC Open
Difficulty 5/5 Over a week Newbie friendliness 1/100
MetaMask/delegation-framework#183 ·
All issues in MetaMask/delegation-framework
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
MystenLabs/sui#28056 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
filecoin-project/solstice#76 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
CypherBoxLLC/Cypher-Box#283 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
blinklabs-io/bursa#904 ·