5

EIP-777 came out in late 2017 and yet many projects still use ERC20 token standard. The only one I've heard of using ERC777 was UNI which was hacked because the attacker was able to set how the tokensToSend function was called and by whom.

Anyway, I see the mint, burn, and send/receive hooks as rather useful and instead of trying to re-invent the wheel by developing this functionality in an ERC20 based Dapp was thinking that ERC777 should just be used rather than ERC20.

If you take a look at the Ethereum Token Standards, they simply list ERC20 as one of the most "popular" but never refer to it as "best practice".

2
  • 1
    This is a specific instance of a wider phenomenon called path dependence. It's an issue that all large groups of people must deal with (including the Internet-native Ethereum community). Commented Apr 3, 2021 at 15:44
  • @PaulRazvanBerg Agreed Commented Apr 4, 2021 at 3:16

1 Answer 1

3

As you mentioned, ERC777 has send/receive hooks. These hooks allow for a number of neat features, however they open the door for reentrancy attacks. This is the same type of attack that drained the DAO (using ETH).

I believe the reason ERC777 is not widely used is because some smart contract developers do not defend against token reentrancy. Most contracts are created with the assumption that tokens cannot be reentrant, and ERC777 breaks this assumption.

2
  • 1
    Thanks Shane. Do you have any good link/tips on how to defend against token reentrancy? Commented Mar 31, 2021 at 20:45
  • Yea I think the best way to learn would be to study what happened to The DAO. Here is one great resource! Commented Mar 31, 2021 at 22:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.