Problems and issues of ERC-20 token standard

Jeffrey Hancock
6 min readApr 17, 2020

--

Take a detailed look at the main sources of vulnerabilities and problems in ERC-20 tokens.

ERC-20 (Ethereum Request for Comments) is the first and most widely used standard for Ethereum tokens. It was first introduced in 2015. Thanks to the introduction of ERC-20 there was a massive increase in ICO campaigns in the crypto market, as it describes a specific list of specifications and rules to which future tokens must conform.

Simply put, ERC-20 tokens are specialized smart contracts that operate on the basis of the Ethereum blockchain. This standard has greatly facilitated the work of developers who previously had to develop standards for the compatibility of tokens with blockchains, wallets, exchanges and DApps. To date, there are more than 65 000 ERC-20 tokens have been launched on the Ethereum network. Among the most popular ERC-20 tokens are EOS, Tron, Binance Coin, ICON, KuCoin, OmiseGO and SingularDTV.

How does it work?

The ERC-20 standard code has 6 functions:

  • The totalSupply function determines the total number of tokens;
  • The balance0f function shows the balance on the account of a certain address specified by the address _owner parameter, where _owner is the desired address;
  • The transfer function transfers tokens from the primary address to the address of an individual user, for example, a member of ICO;
  • The transferFrom function is used to send tokens from one user to another;
  • The approve function checks whether tokens have remained in the smart contract and allows funds withdrawal from the account up to the maximum allowed amount, which is specified as a parameter of the function;
  • The allowance function guarantees that there are enough tokens at the sender’s address for sending them to the recipient’s address.

ERC20 also provides two types of events:

  • transfer — the event of transferring tokens between accounts;
  • approval — the event is initiated when the approve function described above is successfully executed.

These functions and events are the basis for how ERC20 tokens are sent between addresses and how their holders can obtain information about their tokens. They also serve as a guarantee that the new tokens will fully function on the Ethereum platform.

ERC-20 problems and disadvantages

ERC-20 is the first standard developed in the Ethereum network, and therefore it has significant shortcomings. Blockchain developer known as Dexaran has described in detail the bug that can cause users to lose money in transactions.

According to the developer’s analysis, the key problem is with smart contracts. A transaction is considered completed when the funds are successfully transferred. If an error occurs, the transfer should be rejected. When transferring ETH, this is exactly what happens: if tokens is sent to a contract that is not compatible with this cryptocurrency, the transaction will be rejected by the smart contract on the part of the recipient and the transfer of funds will not occur. However, in the case of tokens ERC-20 standard, everything happens differently: a smart contract that does not support this standard, does not reject the transaction, as a result of which the tokens are frozen and lost.

This is due to the fact that to transfer ERC20 tokens one of the two functions has to be activated. The first one is the transfer function, which allows you to send tokens to a specific address. The second is used to deposit tokens into a smart contract, which requires a combination of functions approve + transferFrom. Thanks to the approve function, the user allows a smart contract to withdraw his own funds, which is done with the transferFrom function.

But what if by mistake the user makes a deposit into a smart contract using the first transfer function? The transaction will be considered successful and the network will recognize it, but the smart contract itself will not see this transaction and therefore will not credit it. For example, if you send tokens to a decentralized exchange contract in this way, the contract will receive these funds, but they will not appear on the balance. Moreover, if such contract cannot implement the function of emergency token withdrawal, in this case it will be impossible to return the sent funds. It is because of this bug Ethereum ecosystem has already lost millions of dollars.

Still, you can make money with ETH. Just visit our blockchain lottery Ethex.bet to earn coins!

How to solve these problems?

As Michael Mulders, a blockchain developer at The Ledger, noted, to combat this problem, Ethereum community members have released alternative token standards that may replace ERC-20 in the future.

ERC-223 standard

ERC-223 was developed by the user Dexaran, who analyzed in detail the work of ERC-20 tokens and released an alternative in March 2017. ERC-223 allows token transactions to behave in the same way as ETH transactions — in case of an error in the transfer function the transaction is cancelled and the funds remain with the sender. For this purpose, ERC-223 introduces new functions that are not available in ERC-20, namely:

  • A single transfer function (instead of transfer and transferFrom) with three parameters address _to, uint _value, bytes data;
  • The tokenFallBack function for the receiving contract, which defines the type of coins sent.

Thus, if an error is made in one of the three parameters of the transfer function, or the contract does not support the tokenFallBack, the transaction will not take place and the funds will be returned to the sender’s address.

ERC-777 standard

Its main goal is to solve ERC-20 problems in the form of lack of transaction processing mechanisms. Therefore, this token standard offers a wide range of tools to process token transactions. For this purpose, ERC-777 standard uses a new set of features:

  • Instead of the transfer function, there is a single send function;
  • Instead of approve, authoriseOperator is used;
  • Instead of tokenFallback, there is tokensReceived.

This approach ensures that these functions will not interfere with functions of other token standards. Among the drawbacks, however, developers note that the new token functions of ERC-777 can indirectly take over ERC-20 token bugs as they will not block them.

Also, the standard ERC-777 uses a new method of contract interface recognition, which provides a central registry of contracts in the Ethereum network. Any user can refer to this registry to see if the address supports the required set of features, in other words, checks its interface. This also solves the Ethereum problem, where it’s impossible to find out what features a particular contract supports.

Other standards

The developers also presented such standards as ERC-827, which combines the advantages of ERC-223 with the features of ERC-20. Or the standard ERC-664, which allows you to update token contracts, but carries a critical bug ERC-20.

The introduction of the new token standard is a time-consuming process, which should involve not only Ethereum members, but also exchanges, wallets and DApps developers planning to work with new tokens. However, work on solving the problems and bugs of ERC-20 has already started, which means that changes in the Ethereum ecosystem are inevitable.

Earn Ethereum at our fair crypto lotto Ethex.bet!

--

--

Jeffrey Hancock
Jeffrey Hancock

Written by Jeffrey Hancock

Blockchain enthusiast developer and writer. I love video games, blockchain and the hot symbiosis of these two worlds.

No responses yet