I analyzed this token contract on open-zepplin here : https://github.com/OpenZeppelin/zeppelin-solidity/blob/master/contracts/token/ERC20/StandardToken.sol

I wonder why there is not a statement in approve function which should check whether owner holds those tokens.

1 Answer 1


Because the balance is checked at transferFrom anyway. In between the calls, the balance could have been updated; the user could have transfered their tokens just before transferFrom is called. That means that any security has to be implemented on transferFrom, and when that is done, approve does not need to do the checks

  • I agree with the check in transferFrom but how this case feels, a person who doesn't own any tokens can approve another address for spending them. This doesn't look like an ideal case.
    – Aniket
    Commented Apr 18, 2018 at 8:05
  • What does an approval mean if tranferFrom cannot be carried out? Nothing, I'd say. So, there should be no problem.
    – Henk
    Commented Apr 18, 2018 at 8:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.