I'm trying to build a crowdsale contract for an existing erc20 token. This the function allows users to buy the token:

function buyTokens(address _beneficiary) public onlyApproved(_beneficiary) onlyBefore(endTimestamp) payable {
    require(msg.value > 0);
    uint256 tokensAmount = mul(msg.value, rate);
    weiRaised = add(msg.value, weiRaised);
    require(token.transferFrom(address(this), _beneficiary, tokensAmount));
    emit TokenPurchase(msg.sender, _beneficiary, msg.value, tokensAmount);

The address of the crowdsale contract has been approved from the token owner to transferFrom his wallet to the buyers wallet. What I'm wondering now is if the function is vulnerable to a recursive attack. Thanks.

  • it shouldn't call the fallback. Am I correct?
    – user38075
    Commented Aug 7, 2018 at 14:25

1 Answer 1


You are right, transferFrom will not call the fallback and furthermore, transferFrom is a function in a contract that you know, it won't call back your crowdsale contract in any way.

Hope this helps


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.