Warning from ClassicEtherWallet

hanhj239 · March 1, 2018, 1:24pm

Hi team,

I saw this warning in ClassicEtherWallet. Who do you know what it is?

“There is a security vulnerability in ERC20 token standard. ERC20 tokens are insecure!
Use ERC20 tokens at your own risk. ClassicEtherWallet is not responsible for the consequences of using tokens of this standard.
Do not transfer ERC20 tokens into any smart-contract using the transfer function. This will result in the loss of your tokens.”

Thanks.

mast3rk3rn3l · March 1, 2018, 4:56pm

Read this:point_down:

gist.github.com

https://gist.github.com/Dexaran/ddb3e89fe64bf2e06ed15fbd5679bd20

ERC20_token_standard_vulnerability_classification.md

Previously described at: [ERC20 critical problems medium article](https://medium.com/@dexaran820/erc20-token-standard-critical-problems-3c10fd48657b).

## Description.

[ERC20](https://github.com/ethereum/EIPs/issues/20) is the most common Ethereum token standard. It should be noted that it is also the first Ethereum's token standard as well. 

It is also important that the original [ERC20 proposal](https://github.com/ethereum/EIPs/issues/20) is a definition of token *interface*. EIP20 does not define a reference implementation for this token standard. Here is OpenZeppelin implementation of ERC20 token: https://github.com/OpenZeppelin/zeppelin-solidity/tree/master/contracts/token/ERC20

ERC20 token standard implementation assumes two ways of token transferring: (1) `transfer` function and (2) `approve + transferFrom` pattern.

This file has been truncated. show original