I want to create a super simple token for my community. I read some tutorials and I found this code:

pragma solidity ^0.5.2;

import "./lib/oz/contracts/token/ERC20/ERC20Pausable.sol";
import "./lib/oz/contracts/token/ERC20/ERC20Capped.sol";
import "./lib/oz/contracts/token/ERC20/ERC20Detailed.sol";

contract CappedToken is ERC20Detailed, ERC20Capped, ERC20Pausable {

    // ------------------------------------------------------------------------
    // Constructor
    // ------------------------------------------------------------------------
    ERC20Detailed("DEMO Tokens", "DEMO", 18) 
    ERC20Capped(1000000000000000000000000000) // 1B
    public {}

3 questions:
Is this code secure or hackable in any sort of way?
Only the smart contract creator address is allowed to mint token right?
Is Pausable strictly necessary?
Thank you very much.

2 Answers 2


As you are using OpenZeppelin contracts you should be quite safe from various exploits - unless you have such in your own code which utilizes OpenZeppelin. OpenZeppelin is well known, widely used and battle-tested.

As for your questions:

1) The code is secure as you are just using OpenZeppelin's functionality and not doing anything strange/fancy yourself. But of course the contracts you inherit add certain functionality and you should be aware of how the functionality works.

2) You are not using a mintable token. There is no minting in your contract. All tokens are created in the constructor (1 billion) and the amount can't be changed afterwards. Furthermore, you are not utilizing any "contract owner" functionality so there is no real owner for the contract.

3) Only the ERC20Detailed is strictly necessary in order to be ERC20 compatible. Or, strictly speaking, even that is not necessary as you could just use the raw ERC20 interface, like it's done here: https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/token/ERC20/ERC20.sol . So, no, the ERC20Pausable is not necessary, it just adds extra functionality.

I would suggest you start with a very basic token (so get rid of ERC20Capped, ERC20Pausable at least) and once you understand how that works you can start adding extra functionality into it with such different inherited contracts.


For a simple token, depending on your requirements, you may not need it to be pausable or even potentially even mintable.

Based on the SimpleToken example you could have something like the following where the total supply of tokens is minted to the deployer of the contract, with no functionality to mint additional tokens.

As always, you should do appropriate testing and auditing on your smart contracts.


pragma solidity ^0.5.0;

import "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import "@openzeppelin/contracts/token/ERC20/ERC20Detailed.sol";

 * @title SimpleToken
 * @dev Very simple ERC20 Token example, where all tokens are pre-assigned to the creator.
 * Note they can later distribute these tokens as they wish using `transfer` and other
 * `ERC20` functions.
contract SimpleToken is ERC20, ERC20Detailed {

     * @dev Constructor that gives msg.sender all of existing tokens.
    constructor () public ERC20Detailed("SimpleToken", "SIM", 18) {
        _mint(msg.sender, 10000 * (10 ** uint256(decimals())));

Question asked and answered in OpenZeppelin Community Forum: https://forum.openzeppelin.com/t/super-simple-token-with-open-zeppelin/1604

If you have questions on using OpenZeppelin you can ask in the Community Forum: https://forum.openzeppelin.com/

Disclosure: I am the Community Manager at OpenZeppelin

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.