ERC-2612 — Permit (Gasless Approval)

Back to Account & Authentication

ERC-2612: Gasless Token Approval

ERC-2612 patches a structural problem with ERC-20: every approval costs a separate transaction, which means users must spend gas before they can use a DeFi protocol. Permit lets users sign an EIP-712 typed message off-chain; the protocol submits it on-chain alongside the actual swap.

Required Interface

function permit(address owner, address spender, uint256 value,
                uint256 deadline, uint8 v, bytes32 r, bytes32 s) external;
function nonces(address owner) external view returns (uint256);
function DOMAIN_SEPARATOR() external view returns (bytes32);

Known Footguns

Phishing replay (sign infinite permit), signature malleability (pre-EIP-2098), nonce griefing (front-runner submits before you), domain separator collisions across forks.

Neo Equivalent: Witness Scopes

Neo solves the same problem at the protocol level. Every Neo transaction includes Signers with witness scopes that limit which contracts may rely on the authorisation. The dApp builds a transaction with WitnessScope.CustomContracts authorising the swap router and the token contract — the user signs the whole tx, and Runtime.CheckWitness(from) succeeds inside the token's Transfer. No Ethereum-style permit signature parsing is needed. The mirror keeps a small permit/nonce method only to demonstrate the replay-protection shape side-by-side.

Live on Neo TestNet

Both implementations are deployed on Neo N3 TestNet (network magic 894710606).

Implementation	Contract Hash	Deploy Tx
Solidity (neo-solc)	0xedd521fdaa7422b7465673fa5df6551590c16aa0	(reused — see 0xedd521fdaa7422b7465673fa5df6551590c16aa0)
Neo C# (nccs)	0xb451279fd8ab0e735e50edd6c6ca7e60eb90b70c	(reused — see 0xb451279fd8ab0e735e50edd6c6ca7e60eb90b70c)

Checked-in snapshot matches on initial nonceOf; the manifest now also exercises the witness-scoped permit nonce bump. Source pairs under docs/standards-mirror/deployments/erc-2612/.

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

abstract contract ERC20Permit {
    bytes32 private constant _PERMIT_TYPEHASH = keccak256(
      "Permit(address owner,address spender,uint256 value,uint256 nonce,uint256 deadline)"
    );
    mapping(address => uint256) public nonces;
    bytes32 private immutable _DOMAIN_SEPARATOR;
    bytes32 private immutable _HASHED_NAME;

    constructor(string memory tokenName) {
        _HASHED_NAME = keccak256(bytes(tokenName));
        _DOMAIN_SEPARATOR = keccak256(abi.encode(
            keccak256("EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)"),
            _HASHED_NAME, keccak256("1"), block.chainid, address(this)
        ));
    }

    function permit(
        address owner, address spender, uint256 value,
        uint256 deadline, uint8 v, bytes32 r, bytes32 s
    ) public virtual {
        require(block.timestamp <= deadline, "Permit: expired");
        bytes32 structHash = keccak256(abi.encode(
            _PERMIT_TYPEHASH, owner, spender, value, nonces[owner]++, deadline
        ));
        bytes32 hash = keccak256(abi.encodePacked("\x19\x01", _DOMAIN_SEPARATOR, structHash));
        address recovered = ecrecover(hash, v, r, s);
        require(recovered != address(0) && recovered == owner, "Permit: invalid signature");
        _approve(owner, spender, value);
    }

    function _approve(address owner, address spender, uint256 value) internal virtual;
}

// Neo: nothing to write at the contract level beyond standard NEP-17 transfer.
// The dApp client builds a single transaction with the appropriate witness scope:

// const tx = new TransactionBuilder()
//   .invoke(swapRouter, "swap", [tokenIn, tokenOut, amount])
//   .signers([{
//     account: userAddress,
//     scopes: WitnessScope.CustomContracts,
//     allowedContracts: [tokenIn, swapRouter]
//   }])
//   .build();
// const signed = await wallet.signTransaction(tx);
// await rpc.sendRawTransaction(signed);

using System;
using System.Numerics;
using Neo;
using Neo.SmartContract.Framework;
using Neo.SmartContract.Framework.Attributes;
using Neo.SmartContract.Framework.Native;
using Neo.SmartContract.Framework.Services;

namespace R3E.Examples;

[DisplayName("DemoToken")]
[SupportedStandards(NepStandard.Nep17)]
public class DemoToken : SmartContract
{
    [DisplayName("Transfer")]
    public static event Action<UInt160, UInt160, BigInteger> OnTransfer;

    public static bool Transfer(UInt160 from, UInt160 to, BigInteger amount, object data)
    {
        if (!Runtime.CheckWitness(from)) throw new Exception("no authorization");
        // ... actual transfer ...
        OnTransfer(from, to, amount);
        return true;
    }
}

Comparison

Concern	ERC-2612	Neo Witness Scopes
Phishing infinite approval	High risk	Scopes auto-expire with the transaction
Signature malleability	Implementation-dependent	Handled at protocol level
Cross-chain replay	Domain separator must be perfect	Chain-id is part of the tx hash
Nonce griefing	Real attack vector	Signatures are tx-bound — no nonces
Code surface	~60 lines per token	1 line: CheckWitness(from)