4

Say someone sends some ERC20 (supposedly) tokens to my ETH address. I then use transfer() function to send these tokens to some other address. The question is - by using a "transfer" function do I risk losing my ethers or other tokens on the same address as I sending tokens from? Or even do I risk losing my ethers or tokens on the same keystore? The reason that I'm asking is this:

  • Do I have to be an expert in solidity and do smartcontract code review every time I am dealing with a new supposedly ERC20 token?
  • What are the risks if I'm not an expart in solidity and don't want to review solidity code of a ERC20 contract that I'm about to use?
Improve this question

2 Answers 2

Reset to default
1

The risks are quite minimal.

The EIP-20 style transfer() function cannot

  • Move your ether around, as you need to manually add balance to your Ethereum transactions in your wallet (the amount field when doing transaction send)

  • Move other tokens around, as if transfer() would call a transfer() of a third party token contract. The malicious contract call would originate from the malicious smart contract address, not from your wallet address and thus it does not have access to your wallet tokens. You would first need to perform explicit EIP-20 approve() call first.

  • The largest risk in the practice is giving approve(amount) on a smart contract that is not trusted or later gets taken over by an attacker. They can pull tokens away from your wallet for any amount you have approved (usually infinite).

Improve this answer
2
  • 2
    I see. So, as far as I understand the maximum amount of damage that a malicious transfer() function can do is the following: instead of transfering a specified amount of tokens to a specified address it could transfer all the tokens from my balance to some other address. Is that correct?
    – Mikhail
    Mar 28, 2018 at 9:03
  • 1
    Yes. Furthermore there are tokens where the token has an owner that can freely take tokens out from other accounts, like Everex etherscan.io/address/… (see moderatorTransferFrom)
    – Mikko Ohtamaa
    Mar 28, 2018 at 9:49
0

If you are calling the token contract from your own contract, then there is a possibility for a vulnerability. You are subject to at least the following issues:

  • Re-entrancy attact
  • Transaction reverting due to 'out of gas' problems

Have a look at https://github.com/ethereum/wiki/wiki/Safety for a good overview of the possible attack vectors.

So, in short, yes, you need to know what you're doing if you're calling an unknown contract from your own contract.

However, if you call the unknown contract from a web3j or from a wallet or somewhere which is not a smart contract, then all you can lose is:

  • The ether you are sending
  • The gas you are using
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.