1

I just deployed an ERC20 token on the Rinkeby testnet. The token has some features like Minting and Burning. After verifying the code on Etherscan I am able to interact with the functions and generate more tokens or burn them as I am supposed to.

However I just realized that whoever has access to the .sol file which contains the smart contract could potentially verify the ERC20 token itself, thus being able to mint or burn instead of me.

enter image description here

Is this even possible? If not, what am I missing in my logic?

Improve this question
2
  • Of course it is possible. Take a look at multisol, it might help you.
    – Paul Razvan Berg
    Sep 15, 2022 at 13:00
  • @Pail thanks for the comment! How are then ERC20 tokens protected from this? Is there some workaround? I found out that there is a onlyOwner() modifier. Is placing this in the function definition enough to prevent what I described?
    – Federico Gentile
    Sep 15, 2022 at 13:06

3 Answers 3

Reset to default
3

That is right. Anybody with the source code can verify any contract.

For example, I deployed this contract:

0xD93f610B9b70E9aCda192091645F48ACfB63C676

with this account: 0x6827b8f6cc60497d9bf5210d602C0EcaFDF7C405

And then I made sure that my Metamask was not connected to etherscan and used incognito, and I was able to verify it:

https://rinkeby.etherscan.io/verifyContract-solc?a=0xd93f610b9b70e9acda192091645f48acfb63c676&c=v0.8.16%2bcommit.07a7930e&lictype=3

Improve this answer
3
  • 1
    thanks for the answer! How are then ERC20 tokens protected from this? Is there some workaround? I found out that there is a onlyOwner() modifier. Is placing this in the function definition enough to prevent what I described?
    – Federico Gentile
    Sep 15, 2022 at 13:06
  • 1
    If only you want to be the minter, yes, you can use onlyOwner. If you want specific addresses to be able to mint, then you should add access control logic, like mapping(address => bool) public whitelisted or something like that.
    – Jeremy Then
    Sep 15, 2022 at 13:16
  • 1
    Awesome that is good news. I was pretty scared cuz I thought anyone could mint instead of me.
    – Federico Gentile
    Sep 15, 2022 at 13:17
2

Yes they could. And in fact if the contract has been deployed before (same bytecode), many explorers are automatically verifying it. But the big thing you should know is that people can interact with your contract even if it's not verified. You should have access controls built into the smart contract, meaning only certain addresses can do the minting or burning.

Improve this answer
3
  • thanks for the answer! How are then ERC20 tokens protected from this? Is there some workaround? I found out that there is a onlyOwner() modifier. Is placing this in the function definition enough to prevent what I described?
    – Federico Gentile
    Sep 15, 2022 at 13:06
  • yup! That's the way to do it.
    – thefett
    Sep 15, 2022 at 13:59
  • @FedericoGentile If you want it so only your account can mint and burn tokens, you need to write that in the contract: if someone else tries to mint or burn tokens it won't work. Obviously one way to do that is with onlyOwner.
    – user253751
    Sep 15, 2022 at 21:42
1

Verification has nothing to do with minting or burning.

Only the compiled form of the contract is deployed on the blockchain. Not the source code.

Verification means that someone uploads a copy of the source code to (in this case) Etherscan, then Etherscan compiles it to make sure it's actually the same code, and if it matches, it gets displayed on Etherscan. This is all to do with the Etherscan website, totally unrelated to the actual blockchain.

Until someone puts the source code on Etherscan, Etherscan has no idea how to call the contract properly. That's probably why you thought verification had something to do with calling. But anyone who could work out the correct way to call the contract (by looking at the compiled code) could have called it before.

If you want to make it so only a certain person can burn or mint tokens, you need to write that into the contract. One way to do that is with onlyOwner, as other people have said.

Improve this answer
1
  • Thank you very much for the answer!!
    – Federico Gentile
    Sep 16, 2022 at 6:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.