Timeline for ERC20 vulnerability? Executing transferFrom undesirably
Current License: CC BY-SA 4.0
20 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 26 at 4:10 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
| Sep 27, 2023 at 6:03 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
| May 26, 2023 at 18:02 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
| Jan 24, 2023 at 13:02 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
| Sep 19, 2022 at 23:04 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
| May 21, 2022 at 15:04 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
| Jan 8, 2022 at 23:04 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
| Sep 2, 2021 at 2:06 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
| Apr 25, 2021 at 15:06 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
| Dec 26, 2020 at 13:01 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
| Aug 25, 2020 at 18:03 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
| Apr 18, 2020 at 18:04 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
| Dec 17, 2019 at 2:02 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
| Nov 15, 2019 at 8:45 | comment | added | Moliholy |
This is a different issue triggered in a very similar way. Your issue is about calling approve twice, the attacker listening for the second one and triggering transferFrom before the second approve arrives. This attack vector is very limited to a sole attacker and a second call to approve, which makes it not so relevant. However the attack I'm describing can be executed by ANY attacker that pretends to destroy the business model of a DApp.
|
|
| Nov 15, 2019 at 3:49 | answer | added | Ismael♦ | timeline score: 1 | |
| Nov 15, 2019 at 0:36 | comment | added | goodvibration | Here is the post (possibly one out of several): blog.smartdec.net/…. | |
| Nov 15, 2019 at 0:34 | comment | added | goodvibration |
Not your imagination, but has already been posted publicly some two years ago. One workaround is to allow approve only when the current approved amount is zero. Another workaround is to implement a couple of additional functions - increaseApproval and decreaseApproval.
|
|
| Nov 15, 2019 at 0:09 | history | edited | Moliholy | CC BY-SA 4.0 |
added 2 characters in body
|
| Nov 15, 2019 at 0:02 | history | edited | Moliholy | CC BY-SA 4.0 |
added 3 characters in body
|
| Nov 14, 2019 at 23:52 | history | asked | Moliholy | CC BY-SA 4.0 |