5

Someone has created a tx in which my address has supposedly "transferred" 0.00 USDC tokens to another address on Polygon, along with dozens of other addresses also transferring 0.00 DAI/WETH/USDT: https://polygonscan.com/tx/0x5e9ca4a00732d27be81740ccadf2d8758a6d175827a6dfac46578e0e79814484

Judging by the wording, you could've correctly guessed that my private key hasn't been used to sign the tx. Besides, the contract in play didn't have approval for any amount of any tokens issued by my address.

FYI: the DeBank app perceives this tx as an "Approve 0.0000 USDC for 0x2038…e9ba". "Approve" - not "Transfer"...

To make things even more interesting/weirder, the recipient of the 0.00 USDC is somebody I actually know (and with whom I transact from time to time). I can't believe the coincidence...

Having said all that, how is it possible to initiate transfers of tokens (even if the amount is 0.00) from multiple addresses you don't own nor have token approvals from?

Also, why bother doing this? What do they have to gain?

Improve this question
6
  • 1
    Does the transaction fully match your address? Or just the start and end?
    – mikemaccana
    Feb 21 at 14:11
  • @mikemaccana, the tx contains multiple transfers. One of them contains my address (in full) as the "sender" of the tokens, yes.
    – Iaroslav
    Feb 21 at 20:32
  • 1
    Ah interesting. There has been a popular attack where one uses the 'grinding' method (usually used for vanity addresses, like sol or note or computebudget) to come up with addresses that look like other wallets. But in this case your full wallet address was used, but a look-alike for your friends wallet was used. I can't answer how your wallet was involved in a eth transaction you didn't sign as I don't use eth but I hope that helps.
    – mikemaccana
    Feb 21 at 22:49
  • 1
    @laroslav That's the attack I'm thinking of... someone finds a wallet A, finds another wallet B that A frequently transacts with, grinds keys to look like B, does transactions with A as the fake B, eventually A sends tokens to fake B since fake B appears in A's transaction history.
    – mikemaccana
    Feb 23 at 10:05
  • 1
    @mikemaccana, yes, my train of thought exactly! Gotta be careful out there... :)
    – Iaroslav
    Feb 23 at 16:45

2 Answers 2

Reset to default
8

This is just new way to do scam to the ethereum addresses. Scammer are creating new address which looks alike the address the user is constantly sending the token or any ERC20 token like USDT, USDC. The scammer want you to copy that random alike address and send your funds to that address such that you are assuming the address you are copying from etherscan or polygonscan to be the address you know. EG Lets say you know the address and contantly sends funds to this which looks like

0x1abc......fdb9

Now, the scammer are creating alike address eg 0x1abd...fdb9 now you will copy that address from etherscan or polygon scan (which scammer wants you to copy) and send money to that so that your funds are sent to "alike" but wrong address and hence your funds are lost.

That's why they are using transferFrom function of ERC20 to inject a wrong alike address to the blockchain and that record is shown in etherscan, bscscan, polygonscan to fool the user.

Stay safe from such scam and double check the address is correct before sending any fund.

Improve this answer
4
  • 1
    I did double-check that it is indeed my address that has "sent" the tokens to a friend's address. After all, that's how I found out about the tx (it's shown up in my tx history). However, your answer got me thinking, and I also double-checked my friend's (the recipient's) address - and guess what? It really is just a look-alike and not the actual address of my friend! I don't copy addresses from my tx history when I'm creating new txs, but if I were, they would've, probably, got me!
    – Iaroslav
    Feb 21 at 20:43
  • Now, the question that is yet to be answered is how they've managed to make my address "transfer" 0 USDC tokens to that look-alike address... Any idea?
    – Iaroslav
    Feb 21 at 20:45
  • 1
    Actually the default allowance amount is 0, this is the standard ERC20, so you can send 0 amount from any address to any other address in all existing ERC20 tokens. So, the scammers are taking advantage of this.
    – Safi
    Feb 22 at 4:03
  • That's good to know! Thank you, Safi!
    – Iaroslav
    Feb 22 at 20:55
2

Technically speaking, It's possible for an account to transfer from your account to another account.

The transfer would work if you approved that contract to spend your tokens.

The contract might be trying to transfer what ever approval it has.

For instance;

 require(currentAllowance >= amount, "ERC20: insufficient allowance");

If you have 0 allowance and try to spend an amount of 0. The call will pass.

However, if you have approved that contract to spend an amount, the contract could try to look for the allowance and then transfer it.

Improve this answer
4
  • 1
    Are you saying that any contract is allowed to send 0 tokens from any Ethereum address, even if that address hasn't specifically issued an allowance for the contract? Like, because the spenders' allowances are, probably, kept inside the ERC-20 contracts as mappings, and the default value for a key that doesn't yet exist in the mapping is 0?
    – Iaroslav
    Feb 21 at 20:38
  • Any account can transfer 0 amount of something as long as they pay the gas.
    – MadeInDreams
    Feb 22 at 1:54
  • Yes the allowance is recorded in the token contract. The token will not move until some spend the allowance.
    – MadeInDreams
    Feb 22 at 1:55
  • 1
    Thank you for the clarification, MadeInDreams!
    – Iaroslav
    Feb 22 at 20:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.