I wonder if token contracts without transfer (or send, call) can affect someone's "real" assets (not the tokens).

For example, the contract from: https://etherscan.io/address/0xc5d105e63711398af9bbff092d4b6769c82f793d#code

is known to have an integer overflow vulnerability at line 261: (CVE-2018-10299: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10299)

However, this contract does not have code that sends Ethers to some contracts.

In such cases, how can bugs have bad influences on someone's real money?

  • What do you mean with "real money"? Ethers? Fiat? Aug 4, 2021 at 11:09
  • @LauriPeltonen I wanted to say any of the two. But it seems they can be exchanged each other, can't they? (e.g., fx-rate.net/ETH/USD). Do I have to differentiate them in the context of real money?
    – formal
    Aug 4, 2021 at 11:29
  • Well, you can't input fiat into a smart contract, so yes there is a difference. So let's consider Ethers Aug 4, 2021 at 11:31
  • @SunbeomSo The bugs allows anyone to mint a large amount of tokens diluting the value to legitimate token owners.
    – Ismael
    Aug 6, 2021 at 6:50

1 Answer 1


Usually if a contract is not meant to handle Ether, people don't send it Ethers. It's an accident if they do, and then the Ethers are typically stuck there forever, since there is no way to transfer Ethers out of the contract. The Ethers are then considered lost for good.

If a contract is meant to handle Ethers, it should have all the necessary functionality to transfer it also out, with some logic. This logic can of course have bugs, which may mean that the Ethers gets stuck in the contract or that undesired parties get access to the Ether

However, if we are talking about centralized exchanges, they handle assets differently. When you trade in a centralized exchange, the underlying assets are not transferred inside the blockchain at all - they are only transferred inside the exchange's databases. Only when you request to withdraw your assets, a real transaction is created and the assets are sent to your desired wallet address. So asset trades inside centralized exchanges don't rely on the tokens' coded transfer functionality and therefore possible bugs in the token code don't also matter - until the tokens are withdrawn from the exchange.

  • In the article below, it is said that "... BEC was trading at $0.32 per token, which makes the total dollar value of the exploit around $3.7 novemdecillion ..." : cryptoslate.com/… where the address of the BEC contact is in my original question. Can tokens be exchanged without relying on code in related contracts? The article seems to suggest this.
    – formal
    Aug 4, 2021 at 11:44
  • Sorry, but I don't see how that is related to this answer. The answer is not related to tokens Aug 4, 2021 at 11:45
  • I agree with your answer in general, but I still wonder how the bug in the contract without transfer could affect exchanges, as stated in the article (my first comment on this answer is edited)
    – formal
    Aug 4, 2021 at 11:50
  • Ah, you are talking about centralized exchanges. This is the first time you mention it, so I was only answering based on smart contracts in general. Added a section about centralized exchanges in my answer. Aug 4, 2021 at 12:12
  • Thanks for the update. It seems I have to investigate about centralized exchanges more. In your updated answer, "therefore possible bugs in the token code don't also matter - until the tokens are withdrawn from the exchange." <= does this mean that, if some tokens are withdrawn from the exchange, bugs in the token code (without transfer,send,call) can affect someone's Ethers (or other types of assets)?
    – formal
    Aug 4, 2021 at 12:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.