Transfer Security (By Ruleset)

As explained previously, different rulesets and ruleset options range from more permissive to less permissive. Depending upon the ruleset and options chosen, there can be workarounds implemented to attempt to bypass intended rules governing transfers. Defaults have been selected that strike the ideal balance of transfer security and ease of user experience. In case any of the rules are abused at scale, creators can update their ruleset and/or options to move to a higher level of security that thwarts more of these evasion techniques.

In the following tables below, a checkmark denotes that the ruleset is secure from techniques the can be used to bypass transfer rules.

Ruleset Vanilla

Blocked Exchange	Pop-Up Exchange	Offline OTC	Escrow Contract	Wrapper Contracts	Trading Multi-Sig Wallets	Centralized Exchange w/EOA	EIP-7702	Batch Tx Stuffing

Ruleset Blacklist

Blocked Exchange	Pop-Up Exchange	Offline OTC	Escrow Contract	Wrapper Contracts	Trading Multi-Sig Wallets	Centralized Exchange w/EOA	EIP-7702	Batch Tx Stuffing
✔

Ruleset Whitelist

Configuration 1

Option Bits Set	Allows EOA OTC	Allows 7702 Delegate OTC	Allows Smart Wallet OTC	Blocks Receivers With Code	Blocks Unverified EOA Receivers	Blocks Unwhitelist Operators
None	✔					✔

Blocked Exchange	Pop-Up Exchange	Offline OTC	Escrow Contract	Wrapper Contracts	Trading Multi-Sig Wallets	Centralized Exchange w/EOA	EIP-7702	Batch Tx Stuffing
✔	✔		✔	✔	Limited		✔	✔

Configuration 2

Option Bits Set	Allows EOA OTC	Allows 7702 Delegate OTC	Allows Smart Wallet OTC	Blocks Receivers With Code	Blocks Unverified EOA Receivers	Blocks Unwhitelist Operators
WLO1	✔	✔				✔

Blocked Exchange	Pop-Up Exchange	Offline OTC	Escrow Contract	Wrapper Contracts	Trading Multi-Sig Wallets	Centralized Exchange w/EOA	EIP-7702	Batch Tx Stuffing
✔	✔		✔	✔	Limited

Configuration 3

Option Bits Set	Allows EOA OTC	Allows 7702 Delegate OTC	Allows Smart Wallet OTC	Blocks Receivers With Code	Blocks Unverified EOA Receivers	Blocks Unwhitelist Operators
WLO2	✔		✔			✔

Blocked Exchange	Pop-Up Exchange	Offline OTC	Escrow Contract	Wrapper Contracts	Trading Multi-Sig Wallets	Centralized Exchange w/EOA	EIP-7702	Batch Tx Stuffing
✔	✔						✔

Configuration 4

Option Bits Set	Allows EOA OTC	Allows 7702 Delegate OTC	Allows Smart Wallet OTC	Blocks Receivers With Code	Blocks Unverified EOA Receivers	Blocks Unwhitelist Operators
WLO1 / WLO2	✔	✔	✔			✔

Blocked Exchange	Pop-Up Exchange	Offline OTC	Escrow Contract	Wrapper Contracts	Trading Multi-Sig Wallets	Centralized Exchange w/EOA	EIP-7702	Batch Tx Stuffing
✔	✔

Configuration 5

Option Bits Set	Allows EOA OTC	Allows 7702 Delegate OTC	Allows Smart Wallet OTC	Blocks Receivers With Code	Blocks Unverified EOA Receivers	Blocks Unwhitelist Operators
WLO0						✔

Blocked Exchange	Pop-Up Exchange	Offline OTC	Escrow Contract	Wrapper Contracts	Trading Multi-Sig Wallets	Centralized Exchange w/EOA	EIP-7702	Batch Tx Stuffing
✔	✔	✔	✔	✔	Limited	Limited	✔	✔

Configuration 6

Option Bits Set	Allows EOA OTC	Allows 7702 Delegate OTC	Allows Smart Wallet OTC	Blocks Receivers With Code	Blocks Unverified EOA Receivers	Blocks Unwhitelist Operators
WLO3	✔			✔		✔

Blocked Exchange	Pop-Up Exchange	Offline OTC	Escrow Contract	Wrapper Contracts	Trading Multi-Sig Wallets	Centralized Exchange w/EOA	EIP-7702	Batch Tx Stuffing
✔	✔		✔	✔	Limited		✔	✔

Configuration 7

Option Bits Set	Allows EOA OTC	Allows 7702 Delegate OTC	Allows Smart Wallet OTC	Blocks Receivers With Code	Blocks Unverified EOA Receivers	Blocks Unwhitelist Operators
WLO1 / WLO3	✔	✔		✔		✔

Blocked Exchange	Pop-Up Exchange	Offline OTC	Escrow Contract	Wrapper Contracts	Trading Multi-Sig Wallets	Centralized Exchange w/EOA	EIP-7702	Batch Tx Stuffing
✔	✔		✔	✔	Limited

Configuration 8

Option Bits Set	Allows EOA OTC	Allows 7702 Delegate OTC	Allows Smart Wallet OTC	Blocks Receivers With Code	Blocks Unverified EOA Receivers	Blocks Unwhitelist Operators
WLO2 / WLO3	✔		✔	✔		✔

Blocked Exchange	Pop-Up Exchange	Offline OTC	Escrow Contract	Wrapper Contracts	Trading Multi-Sig Wallets	Centralized Exchange w/EOA	EIP-7702	Batch Tx Stuffing
✔	✔						✔

Configuration 9

Option Bits Set	Allows EOA OTC	Allows 7702 Delegate OTC	Allows Smart Wallet OTC	Blocks Receivers With Code	Blocks Unverified EOA Receivers	Blocks Unwhitelist Operators
WL01 / WLO2 / WLO3	✔	✔	✔	✔		✔

Blocked Exchange	Pop-Up Exchange	Offline OTC	Escrow Contract	Wrapper Contracts	Trading Multi-Sig Wallets	Centralized Exchange w/EOA	EIP-7702	Batch Tx Stuffing
✔	✔

Configuration 10

Option Bits Set	Allows EOA OTC	Allows 7702 Delegate OTC	Allows Smart Wallet OTC	Blocks Receivers With Code	Blocks Unverified EOA Receivers	Blocks Unwhitelist Operators
WLO0 / WLO3				✔		✔

Blocked Exchange	Pop-Up Exchange	Offline OTC	Escrow Contract	Wrapper Contracts	Trading Multi-Sig Wallets	Centralized Exchange w/EOA	EIP-7702	Batch Tx Stuffing
✔	✔	✔	✔	✔	Limited	Limited	✔	✔

Configuration 11

Option Bits Set	Allows EOA OTC	Allows 7702 Delegate OTC	Allows Smart Wallet OTC	Blocks Receivers With Code	Blocks Unverified EOA Receivers	Blocks Unwhitelist Operators
WLO4	✔				✔	✔

Blocked Exchange	Pop-Up Exchange	Offline OTC	Escrow Contract	Wrapper Contracts	Trading Multi-Sig Wallets	Centralized Exchange w/EOA	EIP-7702	Batch Tx Stuffing
✔	✔		✔	✔	Limited		✔	✔

Configuration 12

Option Bits Set	Allows EOA OTC	Allows 7702 Delegate OTC	Allows Smart Wallet OTC	Blocks Receivers With Code	Blocks Unverified EOA Receivers	Blocks Unwhitelist Operators
WL01 / WLO4	✔	✔			✔	✔

Blocked Exchange	Pop-Up Exchange	Offline OTC	Escrow Contract	Wrapper Contracts	Trading Multi-Sig Wallets	Centralized Exchange w/EOA	EIP-7702	Batch Tx Stuffing
✔	✔		✔	✔	Limited

Configuration 13

Option Bits Set	Allows EOA OTC	Allows 7702 Delegate OTC	Allows Smart Wallet OTC	Blocks Receivers With Code	Blocks Unverified EOA Receivers	Blocks Unwhitelist Operators
WLO2 / WLO4	✔		✔		✔	✔

Blocked Exchange	Pop-Up Exchange	Offline OTC	Escrow Contract	Wrapper Contracts	Trading Multi-Sig Wallets	Centralized Exchange w/EOA	EIP-7702	Batch Tx Stuffing
✔	✔						✔

Configuration 14

Option Bits Set	Allows EOA OTC	Allows 7702 Delegate OTC	Allows Smart Wallet OTC	Blocks Receivers With Code	Blocks Unverified EOA Receivers	Blocks Unwhitelist Operators
WLO1 / WL02 / WLO4	✔	✔	✔		✔	✔

Blocked Exchange	Pop-Up Exchange	Offline OTC	Escrow Contract	Wrapper Contracts	Trading Multi-Sig Wallets	Centralized Exchange w/EOA	EIP-7702	Batch Tx Stuffing
✔	✔

Configuration 15

Option Bits Set	Allows EOA OTC	Allows 7702 Delegate OTC	Allows Smart Wallet OTC	Blocks Receivers With Code	Blocks Unverified EOA Receivers	Blocks Unwhitelist Operators
WLO0 / WLO4					✔	✔

Blocked Exchange	Pop-Up Exchange	Offline OTC	Escrow Contract	Wrapper Contracts	Trading Multi-Sig Wallets	Centralized Exchange w/EOA	EIP-7702	Batch Tx Stuffing
✔	✔	✔	✔	✔	Limited	Limited	✔	✔

Ruleset Soulbound

Blocked Exchange	Pop-Up Exchange	Offline OTC	Escrow Contract	Wrapper Contracts	Trading Multi-Sig Wallets	Centralized Exchange w/EOA	EIP-7702	Batch Tx Stuffing
✔	✔	✔	✔	✔	✔	✔	✔	✔

Freezing Accounts

As a method of last resort, creators can freeze an account to prevent all transfers to or from the address. This is intended to prevent malicious actors from circumventing any transfer rules the validators have set via unintended routes or exploits. Use of this feature is solely at the discretion of the token creator, and is disabled by default, requiring the token creator to opt in. This operation can be performed on the developer tools user interface, or using the following validator contract interfaces directly.

    /**
     * @notice Adds accounts to the frozen accounts list of a collection.
     * 
     * @dev Throws when the caller is neither collection contract, nor the owner or admin of the specified collection.
     *
     * @dev <h4>Postconditions:</h4>
     *      1. The accounts are added to the list of frozen accounts for a collection.
     *      2. A `AccountFrozenForCollection` event is emitted for each account added to the list.
     *
     * @param collection        The address of the collection.
     * @param accountsToFreeze  The list of accounts to added to frozen accounts.
     */
    function freezeAccountsForCollection(address collection, address[] calldata accountsToFreeze) external;

    /**
     * @notice Removes accounts to the frozen accounts list of a collection.
     * 
     * @dev Throws when the caller is neither collection contract, nor the owner or admin of the specified collection.
     *
     * @dev <h4>Postconditions:</h4>
     *      1. The accounts are removed from the list of frozen accounts for a collection.
     *      2. A `AccountUnfrozenForCollection` event is emitted for each account removed from the list.
     *
     * @param collection          The address of the collection.
     * @param accountsToUnfreeze  The list of accounts to remove from frozen accounts.
     */
    function unfreezeAccountsForCollection(address collection, address[] calldata accountsToUnfreeze) external;

    /**
     * @notice Get frozen accounts by collection.
     * @param collection The address of the collection.
     * @return           An array of frozen accounts.
     */
    function getFrozenAccountsByCollection(address collection) external view returns (address[] memory);

    /**
     * @notice Check if an account is frozen for a specified collection.
     * @param collection The address of the collection.
     * @param account    The address of the account to check.
     * @return           True if the account is frozen by the specified collection, false otherwise.
     */
    function isAccountFrozenForCollection(address collection, address account) external view returns (bool) {
        return validatorStorage().frozenAccounts[collection].nonEnumerableAccounts[account];
    }

Ruleset Vanilla​

Ruleset Blacklist​

Ruleset Whitelist​

Configuration 1​

Configuration 2​

Configuration 3​

Configuration 4​

Configuration 5​

Configuration 6​

Configuration 7​

Configuration 8​

Configuration 9​

Configuration 10​

Configuration 11​

Configuration 12​

Configuration 13​

Configuration 14​

Configuration 15​

Ruleset Soulbound​

Freezing Accounts​