3

I'm studying ERC20 specification and all seems to make sense. Well, all but allowance. I couldn't grasp to the concept and it's usefulness.

What should I use it for? (Should I at all?)

What are the drawbacks of setting an allowance for too high or too low?

  • I believe allowance is used to allow a transfer from 1 address to another – quantumpotato May 19 '18 at 22:27
  • You could also check out this cool website which explains the concept of allowance with graphical animations. – Paul Berg Nov 12 '18 at 13:37
5

Explaining in very simple terms:

Let's say you are the Owner of a property and you have 1000 tokens. You also have 3 persons working under you as "Employee1", "Employee2", "Employee3".

Calling the approve function, the Owner of the property approves Employee1 to use 200 tokens for certain purpose ("address of owner" approves "address of Employee1").

This only approves that "who" is eligible but "how many tokens" is not specified. This is where the allowance function comes into picture: it tells which address is given what amount of tokens to be used (in our case: Owner allows Employee1 to spend 200 tokens).

So Employee1 is only allowed to use 200 tokens of the total of 1000.

Hope it helps!

4

The typical use case is you want to buy something from a contract and pay with ERC20 tokens. Since contracts cannot listen for events so they will never be notified when they receive tokens.

A solution is for the payment operation to split in two parts:

  • approve: The user approves the contract for the value of the payment.
  • transferFrom: The user call the buy function of the contract, and the contract will call transferFrom.

An example contract of this technique is EtherDelta, when you want to deposit tokens you need to approve the EtherDelta contract with the amount you want to deposit and then call the deposit function that will move your token to EtherDelta contract.

This solution has its own issues:

  • There are two transactions to pay for.
  • There is no guarantee that both transactions will succeed. If the first succeed and the second fails then you have to manually revert the first.
  • If you approve a lower value the second transaction will fail.
  • If you approve a higher value then the recipient might transfer all your approved tokens.

The ERC223 has a proposal that allows contracts to be notified when they are the recipient of a transfer of ERC223 tokens. That should solve some of the issues found with the ERC20 approach.

  • If you approve a higher value then the recipient might transfer all your approved tokens. -> Devs could simply check the contracts to see what's going on, but what about non-technical users? Do they have to trust dApps not to withdraw all the tokens they allowed them to transfer? – Paul Berg Nov 12 '18 at 13:46
  • 1
    @PaulRBerg For dapps an audit should prevent this type of errors, wallets can show a warning for values above certain threshold, perhaps a better standard that allows the single transaction... – Ismael Nov 13 '18 at 6:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.