ERC-20 token standard

ERC-20 (Ethereum Request for Comment no. 20) is a proposal created in 2015 that described how a common token must look like in Ethereum.

Here are some references:

• ERC-20 token implementation in solidity
• OpenZeppelin documentation
• Original discussion thread
• “How to create a ERC-20 token” guideline

ERC-20 token standard has a security flaw in its transferring pattern — it doesn’t implement “transaction handling” which is a musthave feature for a financial software. This makes it impossible to properly handle transaction errors and prevent “incorrect” transactions in some cases. At the time of writing this security flaw caused Ethereum token users to lose more than $90,000,000 worth of assets. Here is a script that calculates the amount of lost ERC-20 tokens: https://dexaran.github.io/erc20-losses/

Here is a security statement regarding this flaw. Here is my article that describes the flaw in detail.

It is a well-known problem. The history of a disaster.

I’ve discovered this flaw in 2017. I made quite a lot of publications regarding the issue and I’ll make a summary here. In 2017 I’ve created an alternative ERC-223 token standard that was designed to address the problem of ERC-20.

• The first disclosure of the problem on Ethereum reddit in 2017. There were about $10,000 worth of ERC-20 tokens lost at this moment.
• I warned the authors of ERC-20 about the issue that I discovered during the token standard finalization. There were $16,000 lost at this moment. They expressed a desire to finalize ERC-20 anyways.
• I had a discussion with the members of Ethereum Foundation regarding the token standards.
• Warned the developers of STORJ regarding potential problems with the token standard they are going to use highlighting that their users will lose money. STORJ co-founder replied “We prefer to err on the side of well-tested known to contain a security flaw code”.
• STORJ token holders started losing their funds exactly as I warned.
• I wrote a notification on the ERC-20 official issue thread highlighting the problem of lost tokens. There were $400,000 tokens lost because of the flaw at that moment.
• I requested the removal of ERC-20 contract examples from the ethereum.org page. It was removed afterwards.
• A user lost $130,000 because of the ERC-20 standard flaw and created a number of posts on reddit.
• In 2018 the amount of lost tokens surpassed $1,000,000.
• A user commented a transfer on Etherscan stating that he lost all his tokens to this ERC-20 flaw.
• The creator of ERC-20 said that he doesn’t want to use this standard in his new project.
• The creator of ERC-20 confirmed my statement that the described issue is a security flaw.
• I’ve applied for Ethereum Foundation’s ecosystem support program with a proposal to develop the ecosystem for different token standards in order to solve the problem of users losing their money with ERC-20. My application was rejected.
• Two reddit publications describing the ERC-20 security flaw were submitted. The publication on CyberSecurity subreddit was assigned a “security vulnerability disclosure” status. The publication on Ethereum subreddit was removed by the moderators.
• A user lost $240,000 worth of tokens to ERC-20 flaw.
• The issue was described in the OpenZeppelin contracts library. They replied “That’s a problem of token standard, not our library”. The described issue fits in their Critical severity security vulnerability criteria according to their bugbounty page.
• A user lost $1,000,000 worth of USDT to ERC-20 standard flaw.
• In 2019 I was closely working withing EOS community. It is worth to mention that EOS C++ token logic is based on ERC-223 standard.
• In 2023 there are about $130,000,000 lost because of the unsolved ERC-20 problems.

What was done so far to solve the problem

• ERC-223 token standard was created (you can find more ERC-223 related info here). ERC-777 standard is also worth mentioning as it doesn’t suffer the problems of ERC-20. The logic of NFT token standard ERC-721 is based on ERC-223 transferring logic so it is not affected by the security flaws of ERC-20. NFTs are safe.
• “Token Standard Converter” EIP-7417 was created to make ERC-223 and ERC-20 tokens fully compatible.
• ERC-20 losses calculator script was developed to demonstrate the scale of the problem.
• Ethereum’s EIP procedure doesn’t allow for security vulnerability disclosures in “Finalized” EIPs (here is a comment from EIP editor). I’m proposing the modification to EIP process itself in order to allow for proper vulnerability disclosures. Here are the ongoing debates on ethereum-magicians forum.
• An attempt to escalate the security issue with ERC-20 to Ethereum Foundation was made but there was no response or action from their side.
• I’m describing the flaw in ERC-20 standard through the EIP process. A discussion thread can be found here.
• There is a debate with EIP editors on the relevance of the ERC-20 flaw disclosure here.
• I’m requesting a warning to be placed on ERC-20 in the official docs at ethereum.org.

And a lot more…

A couple of words about myself.

I’m Dexaran, a pseudonymous security engineer & hacker. I’m hanging in crypto industry since 2012.

• I was an active participant of TheDAO split and founded one of the core development teams of Ethereum CLassic (the EthereumCommonwealth).
• TheDAO hacker paid me 1000 ETC for the audit of the ETC multisig.
• I’ve hacked EOS when it was top7 crypto in 2019. Launched a DDOS attack that froze EOS mainnet for a month. It was one of the largest application level attack that caused consensus level problems in the whole history of crypto industry.
• I co-founded a security auditing organization. Not even a single contract that we audited and declared “secure” was ever hacked.
• Once was a security auditor and reviewed more than 800,000 lines of solidity code myself.
• Audited a DEX for John McAfee.
• Designed 51% attack solutions.