ERC-7758 — Transfer With Authorization (modern)

Back to Account & Authentication

ERC-7758: Transfer With Authorization (modern)

ERC-7758 is the actively-maintained successor to ERC-3009. Same idea: a user signs an off-chain authorization to transfer tokens, a relayer broadcasts the signed authorization, the contract verifies and executes. ERC-3009 sat at "Stagnant" but reached production scale via USDC; ERC-7758 ports the same flow to the modern EIP standardisation track with cleaner typed-data shapes and broader fungible/NFT/multi-token support.

Differences from ERC-3009:

• Token-type-agnostic — works with ERC-20, ERC-721, ERC-1155 with the same signature shape.
• Cleaner EIP-712 typehash — uses the modern domain separator conventions (ERC-5267 lookup).
• Per-tokenId nonce isolation for NFTs — separate replay protection per-asset rather than per-account.
• Optional batch authorization — sign multiple transfers in one signature.

Required Interface (delta from ERC-3009)

interface IERC7758 {
    /// Token-type-agnostic transfer-with-auth.
    function executeTransfer(
        address from, address to, uint256 amountOrId,
        uint256 validAfter, uint256 validBefore,
        bytes32 nonce,
        bytes calldata signature
    ) external;

    function cancelAuthorization(address authorizer, bytes32 nonce, bytes calldata signature) external;
    function authorizationState(address authorizer, bytes32 nonce) external view returns (bool);

    /// Optional: batch flow.
    function executeTransferBatch(
        address from, BatchEntry[] calldata transfers,
        uint256 validAfter, uint256 validBefore,
        bytes32 nonce,
        bytes calldata signature
    ) external;
}

The signature is verified via ERC-1271 when the authorizer is a contract, otherwise via ecrecover for EOAs. The flow otherwise matches ERC-3009.

Neo Equivalent: Native Witness Scopes (Same as ERC-3009)

The Neo answer is identical to the ERC-3009 mirror: Neo's witness model already provides signed, scoped transfer authorization at the protocol level. The user signs a transaction that names them as the from parameter; the relayer broadcasts; Runtime.CheckWitness(from) succeeds because the witness scope validates.

ERC-7758's improvements over ERC-3009 — token-type-agnostic shape, cleaner typed-data, batch authorisation — all map to native Neo features:

ERC-7758 (Ethereum)	Neo Equivalent	Notes
Token-type-agnostic shape	NEP-17 / NEP-11 use the same transfer(from, to, …) signature	Already token-type-agnostic
Modern EIP-712 typed-data	Native witness over the canonical tx body — no per-call typed-data assembly	Cleaner because there's no "wrap calldata in EIP-712" indirection
Per-tokenId nonce isolation	Per-account transaction nonce; tokenId carried in the call args	Different replay model — the tx nonce already namespaces
Batch authorization	Single transaction, multiple transfer invocations in script	Native batch — no separate batch interface
ERC-1271 fallback for contract signers	NEP-30 Verify for contract signers	Native equivalent
authorizationState(authorizer, nonce)	Implicit in tx replay protection (consumed nonces)	Same guarantee

What This Mirror Page Adds vs ERC-3009

The two pages cover the same Neo-side answer (witness scopes) but clarify the migration story differently:

• The ERC-3009 mirror targets teams porting USDC-style flows (existing production deployments).
• This page targets teams adopting the modern shape from scratch — greenfield wallets and dApps that want forward-compatible code.

For new code, prefer the plain NEP-17 four-parameter transfer flow with witness-based auth; reach for an explicit "transfer with authorization" extension only if you're integrating with an off-chain service that specifically expects the ERC-7758 selector shape.

Composition

• ERC-3009 — predecessor mirror.
• ERC-1271 + ERC-6066 — signature validation for contract-held authorizations.
• ERC-2612 — permit-style approval. Also covered by Neo's witness scopes; ERC-7758 supersedes the per-token permit pattern.
• ERC-7677 — paymaster web service. Authorized transfers are commonly relayed through a sponsor; the ERC-7677 mirror covers that handshake.

Migration Notes

For Solidity contracts adopting ERC-7758:

1. Drop the executeTransfer(...) machinery for neo-solc ports — the four-parameter NEP-17 / NEP-11 Transfer already does this with witness auth.
2. For batch flows, build a multi-instruction Neo script that invokes Transfer multiple times within a single transaction. The user signs once (the transaction); each invocation is witness-checked.
3. For ERC-1271-style contract-signed authorizations, expose a Verify method (NEP-30) on the authorizing contract.

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

contract ERC7758Token {
    bytes32 public constant TRANSFER_TYPEHASH = keccak256(
        "ExecuteTransfer(address from,address to,uint256 amountOrId,"
        "uint256 validAfter,uint256 validBefore,bytes32 nonce)"
    );
    bytes32 public DOMAIN_SEPARATOR;
    mapping(address => mapping(bytes32 => bool)) public authorizationState;

    event AuthorizationUsed(address indexed authorizer, bytes32 indexed nonce);
    event AuthorizationCanceled(address indexed authorizer, bytes32 indexed nonce);

    function executeTransfer(
        address from, address to, uint256 amount,
        uint256 validAfter, uint256 validBefore,
        bytes32 nonce, bytes calldata signature
    ) external {
        require(block.timestamp >  validAfter,  "auth not yet valid");
        require(block.timestamp <  validBefore, "auth expired");
        require(!authorizationState[from][nonce], "auth already used");

        bytes32 structHash = keccak256(abi.encode(
            TRANSFER_TYPEHASH, from, to, amount, validAfter, validBefore, nonce
        ));
        bytes32 digest = keccak256(abi.encodePacked("\x19\x01", DOMAIN_SEPARATOR, structHash));
        require(_recover(digest, signature) == from, "invalid signature");

        authorizationState[from][nonce] = true;
        // ... balance accounting ...
        emit AuthorizationUsed(from, nonce);
    }

    function _recover(bytes32 digest, bytes memory sig) internal pure returns (address) { /* ecrecover */ }
}

When compiled with neo-solc, drop the executeTransfer flow entirely in favour of NEP-17's witness-checked Transfer. The signed-off-chain authorization is just a normal transaction with the user as a signer.

using System;
using System.ComponentModel;
using System.Numerics;
using Neo;
using Neo.SmartContract.Framework;
using Neo.SmartContract.Framework.Attributes;
using Neo.SmartContract.Framework.Native;
using Neo.SmartContract.Framework.Services;

namespace R3E.Examples;

// Same shape as the ERC-3009 mirror. The relayer broadcasts the user's
// signed transaction; the contract's Transfer call witness-checks the
// authorizing account.

[DisplayName("RelayedToken")]
[ContractPermission("*", "*")]
[SupportedStandards(NepStandard.Nep17)]
public class RelayedToken : Nep17Token
{
    public override string Symbol  => "RLY";
    public override byte   Decimals => 8;

    public new static bool Transfer(UInt160 from, UInt160 to, BigInteger amount, object data)
    {
        // Witness check (run by Nep17Token base) covers the ERC-7758 auth.
        return Nep17Token.Transfer(from, to, amount, data);
    }

    public static void Mint(UInt160 to, BigInteger amount)
    {
        if (!Runtime.CheckWitness(GetAdmin())) throw new Exception("admin only");
        Mint(to, amount);
    }

    private static UInt160 GetAdmin() => (UInt160)"0x0000000000000000000000000000000000000000";
}

Batch Flow

// Wallet builds a multi-invoke script in one transaction.
const script = new ScriptBuilder()
    .emitContractCall(TOKEN_HASH, 'transfer', [from, recipientA, amountA, null])
    .emitContractCall(TOKEN_HASH, 'transfer', [from, recipientB, amountB, null])
    .emitContractCall(TOKEN_HASH, 'transfer', [from, recipientC, amountC, null])
    .build();

const tx = await wallet.signTx({ script, signers: [{ account: from, scopes: 'CalledByEntry' }] });
await rpc.sendrawtransaction(tx);

One signature; three transfers. Native batch authorization without needing a separate batch interface or signature aggregation.