Most users of Ethereum and ERC tokens probably aren't aware of the existence of the
Couldn't users unknowingly call
approve on an ERC token contract, and afterwards have
transferFrom called from the escrow contract without ever having to actually "send" tokens to anyone.
Users might believe the only way to transfer tokens is to directly send them by entering an amount and calling send, but by calling these functions (approve & transferFrom) the user could have funds taken unknowingly if the user fails to understand what functions they were calling and their purpose.
For examples of possible attacks using
An attacker claims he's distributing an airdrop 1:1 with another ERC20 token, and they need you to send a transaction to the real ERC20 and after send another transaction to their airdrop contract. A victim would think it's a free airdrop, and it's safe because they're not actually ever directly sending coins to anyone, but then in reality the victim would be calling approve on the real
tranferFromfrom the attacker's smart contract.
If a popular website featuring an Ethereum tool gets hacked, wouldn't it be possible for the hackers to have the users call these two functions and effectively steal funds without the user ever seeing an amount rendered on their screen.