0
function approve(address _spender, uint256 _value) returns (bool success)

This is the ordinary ERC20 approval method. It's easy to figure out that we have a problem of front-running.

  • Alice gives allowance of 100 tokens to Bob.
  • Later, Alice rethinks her choice, changing it to 50. When this happens, Bob watches the chain, transfers his 100 tokens immediatelly with a higher gas price.

As a result, Bob gains 150 tokens overal instead of 50.

How can we avoid the above situation ? can commit-reveal help ? if yes, how ?

0
1

Using the ERC20 standard as it is cannot solve this problem. Refer to the link below for a proposal to change the ERC20 API to prevent this problem.

https://docs.google.com/document/d/1YLPtQxZu1UAvO9cZ1O2RPXBbT0mooh4DYKjA_jp-RLM/edit

Commit-reveal is a solution to a front running attack, but its use is slightly different. Even if you commit-reveal your problem, a front running attack is still possible because you have to expose the quantity in reveal.

2
  • let's follow your way. Alice first gave 100 token approval to Bob, and now wants to change it to 50. So Alice submits approve method for 0 amount. Bob sees that and immediatelly, calls transferFrom. His transaction was faster. now, Bob has 100 token. I guess, now, the only advantage with this way is that Alice before approving 50 tokens, checks if meanwhile, Bob spent the previous 100 tokens. Alice will see that Bob spent it so won't do 50 token approval anymore. Is this the right way of thinking ? – Nika Kurashvili Feb 20 at 13:30
  • It's just a little better way. – smarteasy Feb 20 at 15:06
0

You can do this in 2 transactions

  • first approve for zero tokens, wait for that transaction to go through
  • approve again for 50 tokens.
1
  • 1
    let's follow your way. Alice first gave 100 token approval to Bob, and now wants to change it to 50. So Alice submits approve method for 0 amount. Bob sees that and immediatelly, calls transferFrom. His transaction was faster. now, Bob has 100 token. I guess, now, the only advantage with this way is that Alice before approving 50 tokens, checks if meanwhile, Bob spent the previous 100 tokens. Alice will see that Bob spent it so won't do 50 token approval anymore. Is this the right way of thinking ? – Nika Kurashvili Feb 20 at 13:25

Not the answer you're looking for? Browse other questions tagged or ask your own question.