Callisto Network

<h4>Callisto Network Security Department is a security auditing organization that has performed <a href="https://audits.callisto.network/audited-projects" rel="noopener noreferrer nofollow">more than 300 smart contract security audits</a> since 2018. Not even a single contract we have approved as “secure” has been hacked afterwards.</h4><h4>From a security point of view, ERC-20 is a poor solution, and we recommend deprecating this standard and using newer ones for creating tokens on the Ethereum blockchain.</h4><h3 id="i-erc-20-contains-a-well-known-design-shortcoming-a-href-https-dexaran820-medium-com-known-problems-of-erc20-token-standard-e98887b9532c-rel-noopener-noreferrer-nofollow-lack-of-transaction-handling-a-which-is-a-critical-security-flaw">I. ERC-20 contains a well-known design shortcoming (<a href="https://dexaran820.medium.com/known-problems-of-erc20-token-standard-e98887b9532c" rel="noopener noreferrer nofollow">lack of transaction handling</a>) which is a critical security flaw.</h3><p>Standardized critical severity security flaw is not acceptable for a standard of digital assets that should focus on the safety of users’ funds.</p><p>ERC-20 transfer function is non-handleable. It can result in permanent loss of funds for end users. According to OpenZeppelin bug bounty criteria, this is a <a href="https://github.com/OpenZeppelin/openzeppelin-contracts/issues/4474" rel="noopener noreferrer nofollow">critical severity security flaw</a>.</p><h3 id=""></h3><h3 id="ii-erc-20-has-three-interpretations">II. ERC-20 has three interpretations.</h3><p>ERC-20 specification is not strict enough. There are currently three types of tokens that pretend to be ERC-20 but behave differently:</p><ul><li>Tokens that return true on successful transfer or transferFrom function execution but revert a transaction on failure. (Example: <a href="https://etherscan.io/token/0x1f9840a85d5af5bf1d1762f925bdaddc4201f984#code" rel="noopener noreferrer nofollow">UNI token</a>)</li><li>Tokens that return true on successful transfer or transferFrom function execution otherwise return false and never revert a transaction (Example: <a href="https://etherscan.io/token/0xbb9bc244d798123fde783fcc1c72d3bb8c189413?a&#61;0xbb9bc244d798123fde783fcc1c72d3bb8c189413#code" rel="noopener noreferrer nofollow">DAO token</a>)</li><li>Tokens that do not return anything and revert a transaction on failure. (Example: <a href="https://etherscan.io/address/0xdac17f958d2ee523a2206206994597c13d831ec7#code" rel="noopener noreferrer nofollow">USDT</a>, <a href="https://etherscan.io/address/0xb8c77482e45f1f44de1745f52c74426c631bdd52#code" rel="noopener noreferrer nofollow">BNB</a> tokens)</li></ul><p>Technically, USDT and BNB are incompatible with the ERC-20 standard as the standard declares that transfer function must have a boolean return value.</p><h3 id=""></h3><h3 id="iii-approve-transferfrom-is-a-pull-transacting-method-pull-transacting-is-not-suitable-for-trustless-systems">III. approve &amp; transferFrom is a pull transacting method. Pull transacting is not suitable for trustless systems.</h3><p>Authorizing a contract to manage tokens on token holders’ behalf introduces security risks for the token holder. Authorizing a contract to spend any amount of funds (i.e., issuing an unlimited approval) is a pattern that must be avoided.</p><p>Read more about the applicability of push transaction vs pull transaction <a href="https://gist.github.com/Dexaran/a9a1a5bfb51d2b7f077f8b6ae5d4c5cd" rel="noopener noreferrer nofollow">here</a>.</p><h3 id="note-for-security-auditors">Note for security auditors.</h3><p>We encourage security auditing organizations and individual security auditors to highlight the known vulnerabilities of the ERC-20 standard in their security reports.</p><p><a href="https://github.com/CallistoSecurity/Smart-contract-auditing/issues/3#issuecomment-1546249168" rel="noopener noreferrer nofollow">That’s how it is done in our reports.</a> It is not legitimate to state that a contract is “secure” if it utilizes ERC-20 tokens without applying additional security restrictions. Such contracts are definitely not safe because end users will lose their funds.</p><p>Callisto Network has been a truly independent security auditor since 2018. We focus on promoting the best security practices to minimize the amount of funds that any crypto users may lose.</p><p>We believe that cryptocurrency adoption is impossible without fault-tolerant services such as those available in existing banking applications.</p><p>➡️ <a href="https://callisto.network/" rel="noopener noreferrer nofollow">Read more about Callisto Network.</a></p><p>➡️ <a href="https://audits.callisto.network/" rel="noopener noreferrer nofollow">Request a security audit.</a></p><p></p>

ERC-20 Standard – Callisto Network Security Department Statement

Table of Contents

Callisto Network

Other articles published on Jul 31, 2023

Binance Becomes First to Receive Operational MVP License in Dubai

Japan Blockchain Association Requests Crypto Tax Reform

Polygon Price Prediction, Can It Bounce Back to $1? Stellar Up 50%, Pomerdoge On Bullish Trend

Whale and Shark Wallets Load Up on Stablecoins Amid Bitcoin's Dip Below $30k

L’Ultra Arena, la plateforme d’Esports révolutionnaire débarque le 8 août !

Cardano (ADA) Price Prediction 2024, 2025, 2026-2030

Join our free newsletter for daily crypto updates!