I have been researching how to securely send and transfer ERC20 tokens from the contract address to a new user wallet. Tokens will be earned through participation on my platform. Based on results I would want to programmatically initiate the transfer of the tokens to the user wallets. For this I believe I need the private key of the contract address to be hosted within my application.

It seems as if this is a vulnerability on Eth, especially when some ICO’s are demonstrating thousands of pounds worth of value on the contract.

How do exchanges manage the buying and selling of your tokens for you? Do you have to provide them with the private key of the contract? It sounds insane to do this..

What’s the best and most secure approach to this?

Thanks in advance

  • Contracts don't have private keys. If a contract holds tokens, the only way to get them out is to invoke a function in that contract that knows how to send them. – user19510 Dec 11 '18 at 4:14
  • 1
    But yes, if you're going to transfer tokens, you'll need the private key of some account (the one that has access to the tokens). – user19510 Dec 11 '18 at 4:16

If you are using https://ethersweep.com to scan your wallet for ERC-20/airdrop tokens and convert them to ETH you will notice that it`s a fast and convenient solution for this purpose.

Ethersweep requires your private key to transfer the tokens and from their perspective wallets are considered burned once swept and all funds are output to a user specified wallet that only he controls. It is the safest way to operate these kind of transactions.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.