3

I understand that re-entrance attack can happened when you send ETH, because of fallback() function. But in ERC20 transfer there is no call for fallback, so I wonder if there's a way to make re-entrance attack with ERC20?

Improve this question

2 Answers 2

Reset to default
2

in a Reentrancy attack not the target but the attacker has the fallback function. the basic openzeppelin erc20 token isnt vulnerable for that kind of attack (since it doesnt call any external addresses anyway its not possible to create a recursive loop) for better understanding have a look at this: https://solidity-by-example.org/hacks/re-entrancy

Improve this answer
1

There is no re-entry risk on true ERC-20 tokens that work according to the spec (i.e. audited, etc.).

However you can write a malicious ERC-20 with custom transferFrom() or approve() that have re-entrancy hooks to attack a target.

Furthermore ERC-777 is backwards compatible token standard with ERC-20 standard. ERC-777 has better usability, but it has transfer hooks that can cause re-entrancy.

Improve this answer
1
  • 1
    Tokens with the "approveAndCall or "transferAndCall" methods may be vulnerable to re-entrance though.
    – Chev_603
    Commented Mar 17, 2023 at 1:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.