Since the function seems to always be implemented as public, can't an unfair user just call the tokenFallback() function of a receiver contract?

That way one could let contracts believe that they received the appropriate amount of money, when they actually haven't.

1 Answer 1


The tokenFallback function in a token receiver contract can be called by anyone, but as explained in the ERC223 standard documentation,

NOTE: msg.sender will be a token-contract inside the tokenFallback function. It may be important to filter which tokens are sent (by token-contract address). The token sender (the person who initiated the token transaction) will be _from inside thetokenFallback function.

So the tokenFallback function assumes that the address of the contract which is calling it is the address of a Token contract. There is no way to fake msg.sender, meaning there's no way to trick it into thinking you are a token contract.

  • Since fallback splitted into receive() and fallback() the function tokenFallback is renamed into tokenReceived.
    – Rutrus
    Mar 4, 2022 at 9:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.