Can't people be tricked into calling approve on an ERC token contract, and having their tokens stolen?

Question

Most users of Ethereum and ERC tokens probably aren't aware of the existence of the approve and transferFrom functions.

Couldn't users unknowingly call approve on an ERC token contract, and afterwards have transferFrom called from the escrow contract without ever having to actually "send" tokens to anyone.

Users might believe the only way to transfer tokens is to directly send them by entering an amount and calling send, but by calling these functions (approve & transferFrom) the user could have funds taken unknowingly if the user fails to understand what functions they were calling and their purpose.

For examples of possible attacks using approve and transferFrom:

• An attacker claims he's distributing an airdrop 1:1 with another ERC20 token, and they need you to send a transaction to the real ERC20 and after send another transaction to their airdrop contract. A victim would think it's a free airdrop, and it's safe because they're not actually ever directly sending coins to anyone, but then in reality the victim would be calling approve on the real ERC20 and tranferFrom from the attacker's smart contract.

• If a popular website featuring an Ethereum tool gets hacked, wouldn't it be possible for the hackers to have the users call these two functions and effectively steal funds without the user ever seeing an amount rendered on their screen.

Answer 1

"Yes".

Basically, as I see it, this is a question about "can users be fooled into performing something which leads into assets being taken from them". The answer is almost always yes, no matter whether it's about cryptocurrencies or regular banking.

You are correct that clients may be a bit more transparent and clear when it comes to using the actual transfer functionality and users may understand better that that function transfers the assets somewhere else. But after that it basically only boils down to educating the users.

Most cryptocurrency holders have probably no idea how the tokens actually work and that's generally a good thing - most users also don't understand how the banking systems work but they use the system every single day. It's just a matter of making the system easy to use for users - that's the only way to get wide enough userbase.