Let's assume that a user found themselves interacting with a malicious smart contract, either in the form of a custom smart contract or as a malicious ERC20 or ERC721 token that was sent to their wallet. What is the maximum damage that could possibly incur to the user's ETH or ERC20/ERC721 balance as a result of that interaction? Given that they never initiate an approve transaction first to allow the malicious contract to spend any of the third-party tokens they might hold in that wallet.

1 Answer 1



Let's assume that you are only making transactions from your EOA to the malicious contract, and never to any other contract. This is an important assumption since many phishing websites will pretend that you are not interacting with those ERC-20 when in fact you are making an unlimited approval.

In that case, the malicious contract cannot access any other ERC-20 tokens that you may have in your wallet. Accessing such tokens would require your EOA to call those ERC-20 contracts directly to make a transfer or an approval.

However, the malicious contract could steal 100% of your ETH since you can send an ETH value to the malicious contract with a transaction.

I am not familiar enough with ERC721 to be sure of the answer, so I will let someone else cover that part.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.