Accordin to this article valid ERC20 token must implements number of methods. Among then these two:

function transferFrom(address _from, address _to, uint _value) returns (bool success);
function approve(address _spender, uint _value) returns (bool success);

ERC20 standard does not declares any security advice so, anybody who has contract address, contract ABI and know non-empty address can approve any number of tokens and then - transfer it to any other account?

1 Answer 1


The approve function allows any address to approve a spender to spend coins from their own account (msg.sender).

The transferFrom function only allows any approved spender to spend the approved amount.

This is not a security concern because only the owner of the tokens can approve only their own tokens and only the approved spender can spend.

I suggest looking at a common ERC20 implementation like the one from Consensys.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.