Standards

Approval for All

Approval For All is an ERC721 and ERC1155 operator approval that allows one address to transfer all of an owner's tokens for that contract.

Approval For All lets an operator move every NFT or ERC1155 token you own in that contract.

Approval For All Explained in Detail

Approval For All lets an owner authorize an operator to transfer any of the owner's ERC721 or ERC1155 tokens in that contract. It is broader than approving one token ID.

Marketplaces often use this approval so users do not need to approve every token separately.

Smart contract example

setApprovalForAll(operator, true);

After this call, the operator can usually transfer the owner's tokens until approval is revoked.

Approval For All in Auditing

Approval For All is powerful delegated authority. A malicious or compromised operator can move many assets. Custom implementations can also break standard assumptions.

Auditors review who can set, revoke, query, and rely on operator approvals.

Red flags in code

  • The wrong caller can grant approval.

  • Self-approval behavior differs from the standard without reason.

  • Approval events are missing or misleading.

  • Operator allowlists can be bypassed.

  • Code assumes Approval For All applies to one token only.

How to test or review it

  • Grant and revoke operator approval.

  • Transfer multiple token IDs as the operator.

  • Confirm unauthorized operators fail.

  • Test marketplace-like flows and custody flows.

  • Check custom restrictions and event emissions.

Sources