Let's say I have an ETH address and that same address holds AAA, BBB and CCC tokens. Each token symbol is managed by a different contract (each contract was created by a different person/organization with different private keys). However, the same ETH address was "registered" with each contract (e.g. ICO sale/airdrop/rewards/referral/profit shares).

Can one fraudulent contract steal tokens from the other? For example, let's say the CCC contract contains malicious code that could transfer (steal) AAA and BBB tokens because the owner of the ETH address was tricked into "registering" the public ETH address with the CCC contract (scam). Is that possible or can each contract only access its own tokens?

Follow up question (if I am allowed to ask more than one question):

  • If it is possible, should an inexperience non-developer completely avoid all forms of contract invocations or is there a relatively easy way to determine what a contract can and cannot do with regards your other tokens/ETH?

  • If it is not possible (each contract can only control its own tokens), how do decentralized exchanges trade (transfer) tokens that they do not own?


1 Answer 1


The simple answer is "No"

The more complicated answer is that when your contract gets "a token", your contract doesn't actually get that token put into it. The token still resides with the issuing contract. Your contract simply gets control of the token from the issuing contract.

This means that your contract can dictate to the issuing contract that it should transfer or otherwise deal with that token in the way that you direct.

Determination of your contract's permission to perform these actions is entirely up to the issuing contract, based upon the rules coded into it.

Decentralized exchanges

Most exchanges utilise a contract's ability to delegate authority for control of a portion of your tokens to a third party.

This is achieved in the ERC20 standard by the approve/transferFrom mechanism.

Not the answer you're looking for? Browse other questions tagged or ask your own question.