# Issuer controls for tokens **URL:** \ **Category:** Native Tokens\ **Created:** [1 December 2022 21:48 UTC](https://forum.cardano.org/t/issuer-controls-for-tokens/111086 "2022-12-01T21:48:48Z")\ **Posts on this page:** 18\ **Page:** 1
**Author:** ![kyleo](https://avatars.discourse-cdn.com/v4/letter/k/bc79bd/32.png) [@kyleo](https://forum.cardano.org/u/kyleo)\ **Post date:** [1 December 2022 21:48 UTC](https://forum.cardano.org/t/issuer-controls-for-tokens/111086/1 "2022-12-01T21:48:49Z")
Hello, Everyone. I’m working on a project that I’d love to use Cardano for but I’m not sure if the features required are available for native (obviously not ADA) tokens on Cardano. Can someone let me know if the following is available natively? Asset Issuer needs to be able to “greenlist” access to the token Asset Holder needs to similarly “greenlist” the issuer, and by proxy accepts whatever controls imposed by Issuer Asset issuer needs to be able to clawback or freeze assets (the thing holders would need to agree to) These are important features for regulators in my jurisdiction. If not natively available what would my options be? With the goal of users being able to use whatever wallet/key management system they use today (like metaco, or fireblocks, or ledger, or daedalus) Thank you, ---
**Author:** ![COSDpool](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.cardano.org/cosdpool/32/21482_2.png) [@COSDpool](https://forum.cardano.org/u/COSDpool)\ **Post date:** [2 December 2022 17:49 UTC](https://forum.cardano.org/t/issuer-controls-for-tokens/111086/2 "2022-12-02T17:49:28Z")
@kyleo there’s been a lot of discussion in the last few weeks about managed token behaviour through some proposed standards. In summary, having this behaviour on Cardano has been characterised in these standards discussions as technically problematic and challenges some commercial & ethical principles: > > > The CPS standard is coming from this work-in-progress proposal: https://github.c…om/cardano-foundation/CIPs/blob/cip-cps-rework/CIP-9999/README.md > > The topic of smart tokens at this stage is not ready for a CIP, so I deemed a CPS to be a better fit for discussions. Since the CPS standard is not set yet and also this topic would require proper discussions potentially elsewhere, I also made this as a DRAFT. > > The need to extend the functionality around tokens and their utility was raised in the Interoperability working group - https://github.com/input-output-hk/Interoperability-working-group/issues/16 > > Disclaimer: > I don't think I'm a good fit to define the full requirements for what smart-tokens should fulfill, neither have I the overview of the development direction of Cardano. I also don't have the connections to push this forward. I think experts in regulations, compliance definitely should have a strong say, with dapps and wallets defining how they would work from the UX perspective. My aim here is simply to raise the topic. > > > Allow users to delegate authorized spending of outputs in their wallets to smart… contracts or other users, without sending said outputs out of their wallets. > > This brings benefits to Cardano users when interacting with existing dapps and opens up new use cases, like noncustodial asset management, concurrent use of dapps and seamless integration with sidechains. … including this proposal which was literally written into the `Rejected` state (by one of Cardano’s top architects) based on all the ways the idea was determined to be unworkable and/or undesirable: > > > This adds a rejected CIP recording a possible design that has been discussed in …the past for "spending policies". I wanted to have somewhere to point when it comes up, and also to publicly record the reasons why designs like this are difficult. > > \--- > > \[see rendered Markdown\](https://github.com/michaelpj/CIPs/blob/mpj/spending-policies/CIP-0070/README.md) Personally I’d maintain that what’s “important for regulators” is catastrophic for everybody else. So the best I can offer is to point you & others to these ongoing discussions, so you can decide whether the system you’ve imagined can somehow be layered upon Cardano… I do believe the commercial motive to do this (which you’ve already seen) will cause many developers to attempt similar architectures, and you’d be likely to find ideas relevant to your own if you follow these proposals over time. 🧐 ---
**Author:** ![kyleo](https://avatars.discourse-cdn.com/v4/letter/k/bc79bd/32.png) [@kyleo](https://forum.cardano.org/u/kyleo)\ **Post date:** [3 December 2022 10:27 UTC](https://forum.cardano.org/t/issuer-controls-for-tokens/111086/3 "2022-12-03T10:27:01Z")
Many thanks for the detailed/curated response! If the features are optional what’s the ethical issue here? If the token holders agree to the conditions the issuer has defined what’s the ethical issuer? Personally what’s more catastrophic is not providing features that many regulated businesses need, forcing those business to use other platforms. Someone can develop a token standard using Plutus, implementing these features like ERC-20/721 did, but: 1) that’s bunch more work for the developer/business, 2) requires wallets get updated to support a new dapp 3) the plutus code will need to be audited for every token created 4) regulators are very weary of smart contracts Why not facilitate something natively that can already be done non-natively because people have opinions on its morality? ---
**Author:** ![Terminada](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.cardano.org/terminada/32/80229_2.png) [@Terminada](https://forum.cardano.org/u/Terminada)\ **Post date:** [3 December 2022 11:40 UTC](https://forum.cardano.org/t/issuer-controls-for-tokens/111086/4 "2022-12-03T11:40:14Z")
I guess if your assassin is making you dig your own grave, you probably should dig slowly. Good luck finding people to help you dig. ---
**Author:** ![COSDpool](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.cardano.org/cosdpool/32/21482_2.png) [@COSDpool](https://forum.cardano.org/u/COSDpool)\ **Post date:** [3 December 2022 12:02 UTC](https://forum.cardano.org/t/issuer-controls-for-tokens/111086/5 "2022-12-03T12:02:33Z")
> [@kyleo](#): > > Many thanks for the detailed/curated response! You’re welcome & as I recall, if you read every comment in those 3 discussion threads as well as the reservations that are listed in the proposals themselves, you also will find answers or at least points for consideration about your questions regarding “ethics” as well as the technical difficulties. That’s the best contribution I can make to your project plan so I will leave it at that. The primary ethical consideration of course is not creating opportunities for users to be robbed by each other, or by the protocol developers (while they’re waiting to be robbed by the “regulators”). ---
**Author:** ![kyleo](https://avatars.discourse-cdn.com/v4/letter/k/bc79bd/32.png) [@kyleo](https://forum.cardano.org/u/kyleo)\ **Post date:** [3 December 2022 12:05 UTC](https://forum.cardano.org/t/issuer-controls-for-tokens/111086/6 "2022-12-03T12:05:43Z")
Who is the assassin in your analogy? Cardano will not be successful without transaction fees. If business can’t (easily) use the platform they will migrate (those fees) elsewhere. Seems like its more like suicide… or cutting ones nose off to spite their face. ---
**Author:** ![kyleo](https://avatars.discourse-cdn.com/v4/letter/k/bc79bd/32.png) [@kyleo](https://forum.cardano.org/u/kyleo)\ **Post date:** [3 December 2022 12:07 UTC](https://forum.cardano.org/t/issuer-controls-for-tokens/111086/7 "2022-12-03T12:07:16Z")
Definitely need to read through those posts/threads thoroughly and opine. ---
**Author:** ![Terminada](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.cardano.org/terminada/32/80229_2.png) [@Terminada](https://forum.cardano.org/u/Terminada)\ **Post date:** [4 December 2022 01:50 UTC](https://forum.cardano.org/t/issuer-controls-for-tokens/111086/8 "2022-12-04T01:50:15Z")
> [@kyleo](#): > > Who is the assassin in your analogy? Those that seek to override our natural human rights. I won’t help them build their tools. ---
**Author:** ![kyleo](https://avatars.discourse-cdn.com/v4/letter/k/bc79bd/32.png) [@kyleo](https://forum.cardano.org/u/kyleo)\ **Post date:** [4 December 2022 12:46 UTC](https://forum.cardano.org/t/issuer-controls-for-tokens/111086/9 "2022-12-04T12:46:22Z")
I am taking about providing the facility to enable an optional feature on a token that users choose to interact with. If you do not like/agree with the options business/asset issuer includes in their token then you have every right not to interact with it. In the same way as you can chose to shop at store ABC instead of store XYZ. Why prevent businesses/asset issuers from trying to find customers/users who do like/agree/require these, once again, optional features? ---
**Author:** ![Terminada](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.cardano.org/terminada/32/80229_2.png) [@Terminada](https://forum.cardano.org/u/Terminada)\ **Post date:** [4 December 2022 13:58 UTC](https://forum.cardano.org/t/issuer-controls-for-tokens/111086/10 "2022-12-04T13:58:57Z")
> [@kyleo](#): > > I am taking about providing the facility to enable an optional feature I understand that. And I would prefer that your “optional feature” of clawback was not possible. Then it is a case of “can’t be evil” rather than relying on “won’t be evil”. > [@kyleo](#): > > If you do not like/agree with the options business/asset issuer includes in their token then you have every right not to interact with it. Except if it gets made the standard and everyone trusts that such “optional feature” will only be used to correct something illegal or morally wrong. The problem being that some human gets to decide what is illegal or morally wrong. I suggest you ask the Canadian truckers, and those that donated to their political protest, how the “optional feature” to freeze their fiat bank accounts, played out for them recently. ---
**Author:** ![HeptaSean](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.cardano.org/heptasean/32/82306_2.png) [@HeptaSean](https://forum.cardano.org/u/HeptaSean)\ **Post date:** [4 December 2022 14:50 UTC](https://forum.cardano.org/t/issuer-controls-for-tokens/111086/11 "2022-12-04T14:50:33Z")
> [@Terminada](#): > > And I would prefer that your “optional feature” of clawback was not possible. Even with the discussed spending scripts, clawback won’t be possible, “just” freezing. You can’t spend a UTxO without the signature of the owner and that won’t change. > [@Terminada](#): > > Except if it gets made the standard and everyone trusts that such “optional feature” will only be used to correct something illegal or morally wrong. Why should everyone trust that? That feature would be used by the issuer of a native asset. Trusting _every_ issuer that they only use it for “good” causes would be foolish. Buyers should scrutinise every use of it and this scrutiny is an incentive for token issuers to only mint that into their asset if it is absolutely necessary for their use case or in their jurisdiction. It will never be used for ADA themselves or on an asset, where the issuer did not decide to use it themselves. But it could be valuable to allow issuing _real_ shares of companies as native assets and fulfil the legal requirements for that – instead of the basically lawless “utility” tokens that every project issues today. > [@Terminada](#): > > I suggest you ask the Canadian truckers, and those that donated to their political protest, how the “optional feature” to freeze their fiat bank accounts, played out for them recently. These despicable “protests” are actually a point, why it is _good_ if the government has the power to freeze assets. … ---
**Author:** ![HeptaSean](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.cardano.org/heptasean/32/82306_2.png) [@HeptaSean](https://forum.cardano.org/u/HeptaSean)\ **Post date:** [4 December 2022 15:00 UTC](https://forum.cardano.org/t/issuer-controls-for-tokens/111086/12 "2022-12-04T15:00:40Z")
> [@kyleo](#): > > If the features are optional what’s the ethical issue here? In those CIP discussions I see more technical issues than ethical issues. Allowing spending scripts will be major change to the core protocols that has to be implemented by the nodes as well as every wallet app and other client. If it ever comes, don’t expect it to come soon, rather in years. ---
**Author:** ![COSDpool](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.cardano.org/cosdpool/32/21482_2.png) [@COSDpool](https://forum.cardano.org/u/COSDpool)\ **Post date:** [4 December 2022 15:19 UTC](https://forum.cardano.org/t/issuer-controls-for-tokens/111086/13 "2022-12-04T15:19:57Z")
> [@HeptaSean](#): > > In those CIP discussions I see more technical issues than ethical issues. Sure, the number of little technical problems is greater than the number of more significant & broadly defined ethical problems… the latter including the ethical constraint of “Don’t create an exploitable protocol that loses all users’ funds due to vulnerabilities that have been well known via Ethereum for years” 😝 > > > Programmable Tokens is one of the worst components of the Ethereum ecosystem. It… opens up a Pandora's box of issues that would be super hard to justify for the functionality that they offer. > > approve() & transferFrom() are probably the two most desirable features introduced by Smart Tokens, but they are also immeasurably dangerous and have a hand in practically every one of the 100+ Ethereum exploits totaling to billions of dollars in damages. > > Freezing tokens also comes with its own set of issues and introduces either a lot of complexity (making sure entire UTXOs are not locked just because they have 1 programmable token in them, forcing the inclusion of some type of Spending policy in every single transaction involving UTXOs that contain smart tokens even if the smart tokens are just part of the change UTXO), or a lot of spam UTXOs (ie you cannot have programmable tokens in the same UTXO as ADA / native assets). Already we have so many smart contract vulnerabilities related to unspendable UTXOs, this issue would be compounded greatly. Imagine a malicious actor lists their token on a DEX, gets paired with a ton of ADA liquidity in a pool, and freezes the asset locking everyone's funds indefinitely or someone uses it to bid on an NFT and freezes the auction indefinitely or someone just sends it to any arbitrary smart contract and freezes it thus bricking the contract indefinitely. Dust token attacks (sending out a ton of these "smart tokens" to many different addresses and then freezing spending of the token, thus effectively keeping it stuck in their wallet forever) > > If this is implemented I'd suggest it be a very very small subset of vetted features of programmable tokens to avoid these issues. > > "Supporting this in wallets is needed anyway; wallets need to in general be able to show user funds locked by protocols." > This should be a priority for so many reasons outside of just supporting mock ERC tokens. > > "Single UTXO with Merkle Tree of (owner, amount) pairs. > One UTXO per "coin" with helper token to authenticate coin. Datum would include amount, owner, etc." > > I'm not particularly fond of either of those solutions. > > > I propose the following solution: > Smart tokens are minted to a programmableTokenValidator that enforces that those tokens cannot be sent to anywhere outside the validator address. Each user possessing smart tokens has their own UTXOs locked at the smart contract containing their smart tokens with a datum identifying them as the owner. If Bob wants to send Alice 20 of his smartCoin, he simply spends his UTXO from the script to the script adjusting the datum accordingly. > > !\[programmableTokens\](https://user-images.githubusercontent.com/14356239/205146435-5e69e696-c7f9-4fe8-af95-0bf910564a96.png) > > Then any arbitrary logic can be tagged onto the validator (thus giving us programmable tokens). For instance to add the ability to freeze tokens, we just enforce that the validator checks for the inclusion of a reference Input identified by some auth token managed by the creator of the programmable token. The reference input contains a datum with the field {freeze :: Bool}, if freeze = true the validator does not allow spending of the programmable token, if freeze = false spending is allowed. > > From my perspective, this seems to be the most elegant solution, and also retains all of the security guarantees provided by smart contracts being validators as opposed to actors (as in the case of ethereum). > > This can be expanded to allow sending to validators that will obey the programmable token validator logic and will only send the smart tokens to other such validators (that also obey the token validator logic) or back into the token validator script, such validators can be identified by the presence of a adherenceCertificateToken locked in a UTXO at that script address. > > Alternatively, use the same system, but instead of adherenceCertificateToken, just allow the value to be sent to any arbitrary script, and then deal with it the same way royalties are dealt with, namely, the honor system. All scripts would just collectively reject tokens that did not come from the programmableTokenValidator, this way the only way to get around the programmed logic would be p2p transactions or blackmarket contracts. ---
**Author:** ![HeptaSean](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.cardano.org/heptasean/32/82306_2.png) [@HeptaSean](https://forum.cardano.org/u/HeptaSean)\ **Post date:** [4 December 2022 15:50 UTC](https://forum.cardano.org/t/issuer-controls-for-tokens/111086/14 "2022-12-04T15:50:47Z")
> [@COSDpool](#): > > [CPS-0003? | Smart tokens by szist · Pull Request #382 · cardano-foundation/CIPs · GitHub](https://github.com/cardano-foundation/CIPs/pull/382#issuecomment-1334311589) That (the second part of the comment) is actually a quite elegant proposal totally possible with today’s technology. I like it. ---
**Author:** ![johnshearing](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.cardano.org/johnshearing/32/2634_2.png) [@johnshearing](https://forum.cardano.org/u/johnshearing)\ **Post date:** [5 December 2022 00:10 UTC](https://forum.cardano.org/t/issuer-controls-for-tokens/111086/15 "2022-12-05T00:10:12Z")
Greetings @kyleo, I think I am starting to understand what is being asked. I think you are interested in minting tokens of which it is understood and recorded by the recipient that the tokens can be clawed back. The mechanism to do this was not specified but the CIPs linked by @COSDpool indicate that it could be done with some changes to the protocol. Do I understand so far? Seems to me like a Central Bank Digital Currency (CDBC). I have the following questions please: _So I can understand better, please explain, how is this different from a CDBC?_ _If the intent is central control of a digital asset then why use distributed ledger technology?_ _Wouldn’t you be better using a protocol which is centrally controlled?_ Solana comes to mind but there are many others. While Hydra will make possible millions of transactions per second, a centrally controlled blockchain like Solana can give you pretty good transaction speed now along with the central control desired. _What are your thoughts about using Solana for your project?_ ---
**Author:** ![Terminada](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.cardano.org/terminada/32/80229_2.png) [@Terminada](https://forum.cardano.org/u/Terminada)\ **Post date:** [5 December 2022 08:12 UTC](https://forum.cardano.org/t/issuer-controls-for-tokens/111086/16 "2022-12-05T08:12:13Z")
> [@HeptaSean](#): > > These despicable “protests” are actually a point, why it is _good_ if the government has the power to freeze assets. Countries like Canada and Australia, do recognise a right to protest. Such countries also have a clear separation of powers between the parliament, executive and judiciary, and this is enshrined in their constitutions. The explicit reason for this is so that you can’t end up with one person as dictator becoming judge, jury and executioner. Whether you agree with the Canadian truckers or not is beside the point. It is up to the courts to decide if what the truckers (and their supporters) were doing was illegal. They should have been afforded natural justice. Instead new laws / regulations were passed and banks were instructed to freeze bank accounts. Considering how society has changed, with all money being essentially digital now, this amounted to removal of their ability to feed themselves, pay for clothing, pay for electricity for heating, and pay for fuel to travel. I believe that in our now digital world, removal of the right to access your own money, is removal of a natural human right. ---
**Author:** ![Matias\_Falcone](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.cardano.org/matias_falcone/32/17529_2.png) [@Matias\_Falcone](https://forum.cardano.org/u/Matias_Falcone)\ **Post date:** [3 January 2023 19:39 UTC](https://forum.cardano.org/t/issuer-controls-for-tokens/111086/17 "2023-01-03T19:39:55Z")
Hi @kyleo, I personally agree with you that these features should be provided and that it’s simply a matter of whether someone wants to use them or not. With that said, I think that the requirements of your project are similar to what [Soulbound Tokens](https://forum.cardano.org/t/soulbound-tokens-in-cardano/112379) are trying to bring to the table (correct me if I am wrong). This is a topic I have been researching for a few months now and I believe should be available in Cardano (and I am also willing to develop). I understand the feeling of trying to use Cardano for every project and idea you have, but the reality is, in my humble opinion, that blockchains are simply tools; and you don’t necessarily use always the same tool for everything. So, if you are looking for a blockchain that has those features available natively and you don’t have the time to wait for Cardano, I suggest you look into Algorand: [Algorand Standard Assets (ASAs) - Algorand Developer Portal](https://developer.algorand.org/docs/get-details/asa/#asset-parameters). The parameters you should take a look at are [**Freeze Address**](https://developer.algorand.org/docs/get-details/transactions/transactions#freezeaddr) and [**Clawback Address**](https://developer.algorand.org/docs/get-details/transactions/transactions#clawbackaddr). Let me know if you need any help or have any doubt. I have been working with these kind of assets there. Hope this helps! ---
**Author:** ![kyleo](https://avatars.discourse-cdn.com/v4/letter/k/bc79bd/32.png) [@kyleo](https://forum.cardano.org/u/kyleo)\ **Post date:** [3 January 2023 21:06 UTC](https://forum.cardano.org/t/issuer-controls-for-tokens/111086/18 "2023-01-03T21:06:36Z")
Thanks for the response and the link to Soulbound! Yea. I’ve been looking at algorand quite a bit. Thus far the most appealing tokenization platform is actually Stellar (imho). Which I’ve used for this purpose extensively, but looking for more popular platforms, which is what is behind the desire for Cardano.