0

I noticed a discrepancy in the token balance on Etherscan. A user received a total of 5,029 SPAM tokens in one single transaction, yet their current balance shows 12,809 SPAM tokens. The user hasn’t interacted with or spent any tokens. I’m trying to understand how token balances can differ from the sum of incoming transactions, particularly when there are no other known transactions.

Here’s the URL of the example: https://etherscan.io/token/0xf01f7a348681776c1fc9a066c6973882b693cdc6?a=0x34a7a276ed77c6fe866c75bbc8d79127c4e14a09

Can someone explain how this works? Could it be related to how tokens are managed on-chain, or is there something else I’m missing?

Any insights would help me explain this to our accountant.

Improve this question

1 Answer 1

Reset to default
1

Since the contract isn't verified we don't know for sure.

It's possible that there's a function that emits a Transfer event, and another function that sets the balance of an account. Something like this:

function fakeATransfer(address from, address to, uint256 amount) external onlyOwner {
    emit Transfer(from, to, amount);
}

function setUserBalance(address user, uint256 balance) external onlyOwner {
    _balanceOf[user] = balance;
}

So the amounts can be completely unrelated.

Improve this answer
4
  • Is there any way to programatically verify that that is the case? I'm not sure how I can explain that an incoming transaction of X resulted in a balance of Y, the track records just don't match, which is likely going to raise some eyebrows in the event of an audit.
    – user75610
    Commented Oct 28 at 8:57
  • You have to look at the code. If it conforms to a ERC20 and there's no other way to increase the balance (some tokens can rebalance/rebase automatically ...). There's no programmatic way to do it
    – 0xSanson
    Commented Oct 28 at 11:05
  • Any idea how audit firms handle these cases then? I naively assumed that because it's a public ledger, there would be a nice and clean track record, but if the amount transferred in a transaction can have no bearing on the actual amount received, how can any records be trusted ultimately? I'm not sure how to resolve this issue at scale then if we can't know if the transaction records are actually representative of reality or not.
    – user75610
    Commented Oct 29 at 10:03
  • 1
    Reality is whatever is written in the smart contract. ERC20 rules are pretty lax, so every token can be different, and some stuff doesn't behave like what you expect from coins. For an audit, you can just track the balance and transfer events, and if there's a difference you can explain it as rebase or hidden airdrop in most cases.
    – 0xSanson
    Commented Oct 29 at 15:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.