I've seen a few things today referencing EIP-6551, the (draft) proposal for Token Bound Accounts (Bankless wrote about it here: https://metaversal.banklesshq.com/p/erc-6551) and I figured I'd chime in. TL;DR: I don't think they're particularly exciting or innovative and they have a high potential for danger. 🧵👇

co-founder @chaindrop § software engineer § privacy wonk § music head § theoretical memeticist

I was initially thinking this might be an interesting way to get neophytes an on-chain account: here's your NFT, you're now on-chain! ...but you have to already have an account (wallet) to own the NFT to get the Token Bound Account, so it doesn't work in that scenario. That's okay, they don't say it's for that.

Digging into how the TBA validates transactions: it makes use of `isValidSignature` from EIP-1271, which is on par with the current generation of smart accounts (ala Argent or Gnosis). It does not natively supported `validateUserOp` from EIP-4337 so it isn't natively compatible with Account Abstraction.

As to the potential for danger: I think the existential problem for this proposal is that it puts the entire onus of on-chain security on a single NFT. If someone steals/phishes/scams your NFT, you lose everything associated with the account owned by the NFT too.

For those suggesting you could have your (B|M)AYC hold your BAKCs, OtherDeeds and HVY-MTLs... I can only say that I hope your opsec is pretty top notch.

All that said, for having an identity (like an ENS) own a series of NFTs that spoke to achievements/attendance (POAPS) or even professional certifications all collected together for you to point to and say "this is my web3 persona", it goes a long way toward being an interesting component for reputation systems.

I would personally not hold anything that was either valuable or irreplaceable in a TBA as it is currently specified. If it were an EIP-4337 smart account that implemented social recovery, it would go a long way toward allaying my concerns.

Handy links:
* EIP-6551 draft status proposal: https://eips.ethereum.org/EIPS/eip-6551
* EIP-6551 info site: https://tokenbound.org
* This thread: https://warpcast.com/mrmemes/0xfe4471

You could implement an EIP-4337 smart account that delegated to the `isValidSignature` function on the TBA's EIP-1271 implementation, but then you've got an EOA (wallet) that owns an NFT that has a 1271 smart account that a 4337 smart account can interact with. Hardly the essence of simplicity.