During an Audit I got a warning for this code lines:

https://github.com/ethereum/EIPs/blob/master/EIPS/eip-20-token-standard.md // recommends that there are no checks for the approval double-spend attack // as this should be implemented in user interfaces

function approve(address spender, uint tokens) public returns (bool success) {
    allowed[msg.sender][spender] = tokens;
    emit Approval(msg.sender, spender, tokens);
    return true;

But the audit says I should use this below:

function approve(address _spender, uint256 _value) public returns (bool) {
        allowed[msg.sender][_spender] = _value;
        Approval(msg.sender, _spender, _value);
        return true;

After reading the ECR-20 API it says this is a solution:

function approve(
  address _spender,
  uint256 _currentValue,
  uint256 _value)
returns (bool success)

What is the difference between the first 2? Is this just a difference in Solidity langauge 4.5 vs. 5.0?

I noticed the EIP says that these issues should be handled by the interfece vs an actual check code.

Your thoughts?

  • 1
    The first one is compatible with solc v0.4.21 or higher (due to the usage of emit before event name). The second one is compatible with solc v0.4.20 or lower (due to the lack of emit before event name). The third one is not even a standard ERC20 function (though it will compile under any version of solc). Note that all versions start with '0' (and not '4' or '5' as you've mentioned). – goodvibration Feb 4 '19 at 22:08
  • You should ask the auditor to provide a detailed reasoning for the requested change. IMHO you should use emit and do not rely on old compilers with known bugs. – Ismael Feb 6 '19 at 4:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.