Extension to allow recovery of lost tokens

[k06a]

🎉 Description

I think it will be great to allow some smart contracts to recover tokens, mistakenly sent to them. For example, some people send tokens to the token smart contracts directly, or to smart contracts that just do not support any tokens handling.

• 🐛 This is a bug report.
• 📈 This is a feature request.

📝 Details

I personally extend my token contract with the following method:

function recoverLost(ERC20Basic token, address loser) public onlyOwner {
    token.transfer(loser, token.balanceOf(this));
}

This method can be implemented in RecoverLostTokens.sol and extend Ownable smart contract.

Also contract that support tokens with transferFrom method should track the number of received tokens, to determine if some funds were mistakenly sent:

mapping (address => uint) depositedBalanceOf;

function depositToken(ERC20 token, uint amount) public {
    token.transferFrom(msg.sender, this, amount);
    depositedBalanceOf[token] += amount;
}

function spendToken(ERC20 token, address receiver, uint amount) public {
    require(depositedBalanceOf[token] >= amount);
    token.transfer(receiver, amount);
    depositedBalanceOf[token] -= amount;
}

function recoverLost(ERC20 token, address loser) public onlyOwner {
    token.transfer(loser, token.balanceOf(this) - depositedBalanceOf[token]);
}

👍 Other Information

After publishing this article I am getting multiple requests on Facebook, Twitter, Medium about lost funds every day: https://medium.com/bitclave/how-we-sent-eth-to-the-wrong-address-and-successfully-recovered-them-2fc18e09d8f6

[k06a]

Looks like already implemented?
https://github.com/OpenZeppelin/zeppelin-solidity/blob/master/contracts/ownership/CanReclaimToken.sol

[shrugs]

CanReclaimToken only allows the owner of a contract to reclaim tokens (and perhaps manually distribute to someone that accidentally sent them there).

I feel like I've seen this functionality around before, although I'm not sure where.

The primary issue is that it's hard for a contract to know that a user has sent funds to it with ERC20. Even if it did know, it'd difficult to know how many tokens belong to the user, since they all go into the same "pot" that owned by the contract.

One option would be providing a merkle proof that you'd transferred the tokens to the contract accidentally and then validating that, but it's a bit complicated. I don't think I'm the right person to own this issue, actually, since the correct solution isn't really clear to me off the bat.

[nventuro]

Closing for the same reasons #1109 was closed, see here.