Found old wallet with random tokens on it. Can I get hacked if I try to send or sell these on UNISWAP?

Question

I have an old ETH address and there are some airdrops or random tokens I received. How can I check to make sure these tokens are not scams. Is it possible that if I send these tokens or try to sell them, it will activate some random function to send out all my other tokens? Are all ERC20 token contracts the same or can they be modified to have malicious functions and it will still show up in metamask?

Answer 1

Ok so without either your wallet address or the tokens contract address I can only tell you how to see if it's a scam go to etherscan.com and search your wallet address like so

it should show something like this

if you have tokens in your wallet it should show a thing that says token if you click it will show a list of tokens like this

click on them and look at the contract tab as seen here

now go through all the functions listed on the write and read contract tabs and look for anything suspicious hope this helps

Answer 2

Here is openzeppelin's approve function:

/**
     * @dev See {IERC20-approve}.
     *
     * NOTE: If `amount` is the maximum `uint256`, the allowance is not updated on
     * `transferFrom`. This is semantically equivalent to an infinite approval.
     *
     * Requirements:
     *
     * - `spender` cannot be the zero address.
     */
    function approve(address spender, uint256 amount) public virtual override returns (bool) {
        address owner = _msgSender();
        _approve(owner, spender, amount);
        return true;
    }

Just to be sure here is their _msgSender():

/**
 * @dev Provides information about the current execution context, including the
 * sender of the transaction and its data. While these are generally available
 * via msg.sender and msg.data, they should not be accessed in such a direct
 * manner, since when dealing with meta-transactions the account sending and
 * paying for execution may not be the actual sender (as far as an application
 * is concerned).
 *
 * This contract is only required for intermediate, library-like contracts.
 */
abstract contract Context {
    function _msgSender() internal view virtual returns (address) {
        return msg.sender;
    }

There are generally 2 ways to send tokens, with an optional third way:

1. Direct--you call transfer() in the ERC20
2. Through approvals--you approve another contract to use your funds, and then that contract withdraws funds by calling transferFrom() on that ERC20
3. Through signed approvals, where you sign a transaction which approves your funds for use by another contract. I'm not aware of any ERC20's which use signed approvals so this can basically be disregarded.

When it comes to normal ERC20's, methods 1 and 2 both require you to interact directly with the ERC20 smart contract--you can't approve or transfer funds through an intermediary contract. This means that going through Uniswap or some other trusted protocol will be safe, since there is not usually any way for tokens to be approved or transferred through intermediary contracts at all. Metamask also specifically warns you when you are approving a contract to use your tokens, so that's another layer of defense.

DYOR of course, I wouldn't even bother selling scam tokens just in case. But my understanding is that so long as you're interacting directly with a trusted protocol (such as Uniswap), you should be fine.

Caveats:

-These assumptions only work for normal ERC20 tokens, which should be >99% of all ERC20 tokens. If you own and care about some weird token that does things differently, that one may well be at risk.

-DYOR