ERC-404 and Pandora’s box

Fungible or non-fungible, that is the question.

In today’s Resonance Security sponsored article, I will be looking at the ERC-404 ‘standard’ and the Pandora NFT project from a trading, technical, and security perspective.

Pandora may give you two tokens in one package, but this article gives you three viewpoints!

The quick summary

The ERC-404 token design is not an Ethereum approved standard. It is currently a pseudo-standard, although that may change over time. More on that later in the article.

Combining the features and functions of ERC-20 (fungible) tokens and ERC-721 (non-fungible) tokens into one smart contract, it works using the following rules:

1. If you own more than a predetermined amount of the fungible token, the contract automatically mints a non-fungible token to you.
2. If you spend enough of the fungible token to take you below the predetermined amount, the contract automatically burns one of your non-fungible tokens.
3. Transferring your non-fungible token automatically transfers the predetermined amount of fungible token as well.

Those are the ERC-404 rules. Simple, right?

Here are four examples to illustrate it, using PANDORA as the fungible token name, and with a predetermined amount of 1 PANDORA required to own an NFT:

If you have 0 PANDORA, and someone sends you 0.5 PANDORA and then another 0.5 PANDORA, you will discover that you also now have a shiny new Pandora NFT.

If you then send 0.1 PANDORA to someone else, your Pandora NFT is automatically destroyed.

If you have 1.1 PANDORA and therefore 1 Pandora NFT, and you sell the NFT on OpenSea, after the sale you will have no NFT, and 0.1 PANDORA.

See, I said it was simple.

Why is it called ERC-404?

Over time, Ethereum has developed a process to discuss and eventually approve standards. These are called “Ethereum Improvement Proposals”, and can be found at https://eips.ethereum.org/all.

A standard relating to smart contracts arising from an EIP is called an ERC — an Ethereum Request for Comment, mirroring the Internet Engineering Task Force’s Request for Comments approach for discussing and standardizing Internet protocols. For example, the fungible token standard ERC-20 arose from EIP-20 being approved.

What is the ERC-404 standard, and why did I label it as a pseudo-standard?

The simple answer is that there is no ERC-404, because there is no EIP-404. Visit https://eips.ethereum.org/EIPS/eip-404 and you will get a “404 Page not found.”

There are lots of missing EIP numbers, and the Ethereum developers are still trying to settle on a methodology for allocating them. The number 404 was one of the EIP numbers that was skipped.

The ERC-404 developers grabbed this vacant one that they presumably found funny, and named their idea after it. I doubt that the Ethereum Foundation finds it amusing though.

Co-opting an unused ERC standard number without due process and review sets a bad precedent for the Ethereum development space, but I guess that’s the price you pay for operating in a decentralized world with the possibility of being anonymous and yet still being able to make a profit.

Here’s a prediction: we are going to see a lot more pseudo-ERC standards appearing in 2024 thanks to ERC-404. Perhaps we should start prefixing them with the letter P for ‘pseudo’…

What is the Pandora token?

Pandora is the first release of a smart contract on the Ethereum mainnet that implements the ideas behind the PERC-404, and it was deployed on February 2nd by the people who came up with the idea of a fungible/non-fungible token mash-up in the first place.

The repository for the released contract is here and the deployed contract can be found here.

The token is labelled as “experimental”, presumably as a defense against being blamed for any exploitable bugs that are lurking in the code.

Tests? What tests?

The project repository contains no tests. That’s right — absolutely no tests. Was it tested manually? Are there tests hidden on the developers’ drives that we are not allowed to see? Who knows.

Would you spend 10 ETH (that’s 25,000 USD at the time of writing) on a token implemented with new Solidity code that hasn’t been tested? I wouldn’t.

Auditing for compliance

There is an audit document in the repository, produced by a company called PeckShield. The auditors performed a static analysis of the code, checked whether the contract was ERC-20 and ERC-721 compliant, and found four issues, two ranked medium and two ranked low.

To me, the audit looks brief, with the main focus being compliance with the other token standards rather than any kind of security testing. Perhaps PeckShield wrote and executed some test cases, and perhaps they didn’t. It seems more likely that the project managers paid for a basic review focused on ensuring the token gets listed on DeFi platforms and NFT marketplaces, and not much more.

Is it relevant?

Financially, yes. Pandora has made waves in the NFT community (yes, degens are still alive and kicking, despite the “correction” brought on by the recent crypto-winter), with the ERC-721 compliant NFT collection attracting a floor price of around 9.5 ETH, and both OpenSea and LooksRare seeing trading volumes in the region of 1000 ETH.

Which of these looks more desirable to you?

In the meantime the corresponding fungible ERC-20 compliant PANDORA token is selling at about 9 ETH.

Normally I am not particularly interested in floor prices and trading volumes, but I quote these numbers to show you that there are people out there paying attention and good money for these tokens.

Is there anything else quirky about this token?

Arbitrage

There are interesting arbitrage possibilities between the NFT and the fungible token. You can buy enough PANDORA to create an NFT for 9 ETH on Uniswap, which is lower than the NFT marketplace floor prices. This could be interpreted as putting a price on the risk associated with trading NFTs, and will be interesting to monitor over time.

Speculation

Although it is easy to be dismissive about the ERC-404 concept of fungible/non-fungible token mash-ups, they do introduce a new way for people to speculate on high-value NFTs. The price of an NFT and the price of a unit of the fungible token are coupled, and so someone who believes that the ERC721 token is going to appreciate can get in on a fraction of the action by buying a small amount of the ERC20.

Compare this with Bored Apes or Cryptopunks, where the initial capital outlay is substantial (currently 23 ETH and 57 ETH respectively).

Rarity

Degen NFT collectors are interested in rare traits. Generally speaking I find this odd, although it might be meaningful if you are looking for a cryptopunk that resembles you, I suppose.

The Pandora NFTs have one trait — their color. By transferring 0.5 PANDORA twice from one address to another, you destroy one NFT, and another one is minted with the trait randomly generated, so by ping-ponging your tokens back and forth, you should eventually end up with the color you want, making the rarity of the Pandora NFTs far less important.

Yes, there is a cost associated with it in the form of gas for the transfers, but relative to the current token prices, that is small.

Conclusion

I am all for innovation in the blockchain and token space, and the ERC-404 ‘standard’ provides interesting food for thought. Just some brief contemplation already provides some use cases for the new token type: ERC-20 tokens provide standard financial systems such as payments, loans, trading, and incentivization, but usually lack a sense of branding. NTFs, properly launched, provide an immediate engagement with people, as seen by the oftimes child-like enthusiasm with which their adherents talk about them, but NFTs have a liquidity problem. ERC-404 may just provide the bridge between the two.

The Pandora project looks like it was launched in haste, and the audit is primarily about ERC compliance, which I suspect has more to do with ensuring the token is listed on NFT marketplaces such as OpenSea and LooksRare than it does with providing security to the purchasers of the token.

The Pandora team is already working on a second generation version of the contract, aiming to fix problems such as inefficient gas usage, simplifying the code, and ensuring NFTs are directly transferred rather than being burned and then re-minted.

On the one hand it is worth remembering that even the venerable Cryptopunks went through two releases — version 1 had a bug where selling a punk resulted in both the punk and the sale price going to the buyer.

On the other hand, we are nearly six years on from those early days, when NFTs were still a brand new concept. One would have hoped for an improvement in effort expended on producing smart contracts that are as robust and battle-tested as possible.

About the author

I’m Keir Finlow-Bates, often known as Blockchain Gandalf, and am primarily a blockchain researcher and inventor. I started out on this journey in late 2010 by examining the original Bitcoin code, and have been obsessed with blockchain ever since.

I am also the author of two books on the topic: Move Over Brokers Here Comes The Blockchain, explaining blockchain, and Evil Tokenomics, illustrating through practical examples how web3 scams work.

You can find more at my website: https://thinklair.com

About Resonance Security

Resonance Security is a curated platform for end to end cybersecurity products and services. We function as a concierge for your organization’s end to end cyber-security needs, aggregating valuable security offerings into one platform with the goal of spreading awareness on what it takes to secure your technology stack end to end.

Our platform and security certified team cover: penetration testing, smart contract auditing, blockchain systems and web3 auditing, DevSecOps, and cloud security.

For inquiries visit https://www.resonance.security

Resonance Security New York, NY 10019