FA2.1 / FA3 - It's time

[tom]

@whitelights

• When you transfer the token to someone, then you get the token back, your operators are still set to what they were when you first owned the token. This is unexpected and can allow old (compromised) contracts which were allowed safe to operate years ago to still have operation now when the user is returned the token. Operators should be zerod out upon transfer. We can learn from this mistake in the ERC721 standard on Eth.

Interesting. What should happen for tokens with balance > 1? The operator state should be cleared when the balance reaches 0? Or upon any individual transfer?