So, has there been any smart contracts that interact with other ERC20 tokens that have underflow issues? Like incidents where for example using a specific function that has an underflow where a huge amount of ERC20 tokens are being sent? Any incidents? (When I mean other ERC20 tokens I'm saying that a contract interacting with other tokens like UNI or any other ERC20)

2 Answers 2


The Proof of Weak Hands Coin (PoWHC) was a viral Ponzi scheme created by an internet collective on 4chan. An unsigned integer underflow in its ERC-20 implementation allowed an attacker to exploit the "approve" function. By authorizing tokens for an empty account and initiating a transfer, the account's balance underflowed to 2^256 - 1, enabling the hacker to steal 866 Ethers. The vulnerability stemmed from the "transferTokens" function assuming "msg.sender" as the seller, leading to significant financial damage to the project and its users. Ponzi schemes like PoWHC are inherently risky and prone to exploits.

Refer to this blog for code sample: https://blog.solidityscan.com/integer-overflow-and-underflow-in-smart-contracts-9598032b5a99

  • I know about internal incidents, but what I mean is on a larger scale, like a transfer function that interacts with other ERC20 tokens like UNI for example, where a bad code caused an underflow of UNI tokens or any other token specified by the user, has it ever happened?
    – 19216811
    Jul 28, 2023 at 17:11

Here is a incident happened in 2018, a batchOverflow bug was discovered in certain ERC20 token smart contracts. This vulnerability allowed an attacker to create a specially crafted transaction that would cause an underflow when the contract attempted to process a batch transfer of tokens. As a result, an enormous number of tokens would be sent to the attacker's address. This vulnerability affected multiple ERC20 tokens, and it was a significant concern for various exchanges and token holders.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.