Dexaran

#Pseudonymous smartcontract developer & security engineer

Founder of EthereumCommonwealth & of #ERC223

[Dexaran @Dexaran]

A user @qklpjeth just lost $25,000,000 because of a #ERC20 security flaw that I discovered and reported in 2017.

https://t.co/Sz8qU1pNrd

#ERC20 is an insecure standard. It lack transaction handling which makes error handling impossible.

#ethereum @ethereum

[Dexaran @Dexaran]

@Walodja1987 @Amxx If your token can be handled at the recipients side then you no longer need a separate method of issuing permissions to third parties to move your tokens like approvals

Native currency (Ether) works the same way

ERC-223 is just a re-implementation of the native currency logic

[Dexaran @Dexaran]

@Walodja1987 @Amxx At the base line a token needs a way to be transferred and deposited to smart-contracts. In ERC-223 a very basic technique of a communication model was implemented to allow for transaction handling on the recipients side

Clean and simple

https://t.co/KCj8TBGGDS

[Dexaran @Dexaran]

@Amxx @Walodja1987 ERC-223 is the only standard that actually fixes the problems of ERC-20 i.e. it is the only token standard that satisfies well-known rules of secure software development

This would be impossible with a standard that tries to maintain backwards compatibility with ERC-20

[Dexaran @Dexaran]

@Amxx @Walodja1987 ERC-1363 is insecure. It violates the failsafe defaults principle of secure softawe development by refusing to implement any way of transaction handling within their main transferring function thus making error handling impossible

It trades "security" for backwards compatibility

[Dexaran @Dexaran]

@Amxx @Walodja1987 ERC-1363 is as insecure as ERC-20. Because they both violate the principle of "failsafe default" by not implementing transaction handling within their main transferring function

This resulted in millions of dollars losses https://t.co/HVdrdxNJDb

[Dexaran @Dexaran]

@Amxx @Walodja1987 Redefining the logic of `transfer` func is the only way to make a token standard secure.

ERC-20 violates well-known principles of secure software development i.e. "failsafe defaults" and you as a security expert are supposed to label it with a red warning

[Dexaran @Dexaran]

@Amxx @Walodja1987 ERC-20 is an insecure standard but it was never replaced by any new one because there is no migration process in place.

We are working to establish one with ERC-7417 https://t.co/MurVAbBPzQ

This would require significant coordination efforts and I wish EF could step in

[Dexaran @Dexaran]

@Amxx @Walodja1987 Bitcoin was created in 2009 and Ethereum was created in 2014. If Ethereum was good it would replace BTC as a top1 crypto... or is adoption a bit more complex than "whatever is best gets adopted automatically"?

[Dexaran @Dexaran]

@Dex_223 @zacodil @OpenZeppelin How good of a security researcher are you if you dont point out that the standard you are working with violates well-known security principles and as the result people are losing money using it?

[Dexaran @Dexaran]

@Dex_223 @zacodil Security researchers aren't being fair here.

@OpenZeppelin has a few issue reports on their Github https://t.co/573cShXi62

https://t.co/ZEgfUKZ9nL

but they never documented the issue properly. Their Safe ERC-20 is not safe, it leads to millions of dollars losses.

[Dexaran @Dexaran]

@cryptoupdate_io @sukanto018 @base Shooting yourself in the foot with a pistol or crossbow will have equally dire consequences.

Repeating the same mistakes using different tools won't change the outcome.

[Dexaran @Dexaran]

@jessepollak @A_Leutenegger This is how $25M were lost because ot these problems: https://t.co/XBodCYG8cd

This is a technical description of the problems: https://t.co/XbTOhMlldU

This is a script that calculates the amount of losses: https://t.co/HVdrdxNJDb

[Dexaran @Dexaran]

A user @qklpjeth just lost $25,000,000 because of a #ERC20 security flaw that I discovered and reported in 2017.

https://t.co/Sz8qU1pNrd

#ERC20 is an insecure standard. It lack transaction handling which makes error handling impossible.

#ethereum @ethereum

[Dexaran @Dexaran]

@jessepollak @A_Leutenegger B20 is insecure as it inherits security flaws of ERC20:

- `transfer` lacks transaction handling
- approve+transferFrom is redundant since Tangerine Whistle hardfork

The first resulted in losses of $100M, the second one allowed scammers to steal billions

Your B20 inherits those

[DEX223 @Dex_223]

@jessepollak @A_Leutenegger B20 inherits security problems of ERC-20 and will lead to a loss of millions of dollars of your customers funds

https://t.co/fRyhAbcEax

ERC-20's lack of transaction handling is a security flaw that damages Ethereum ecosystem for years

B20 inherits the same security flaws

[Dexaran @Dexaran]

@A_Leutenegger ERC-20 has unnecessary approves and its `transfer` func isnt handleable. It resulted in $100M loss https://t.co/7ocZpbA4FH

To fix that I proposed ERC-223 in 2017 which works identical to native currency

Adoption is the toughest part here

[DEX223 @Dex_223]

1/ Ethereum needs better token standards🚨

ERC-20 standard is poorly designed and outdated but it’s still the MOST adopted one.

What are its problems and why is it designed the way it is? 👇

[Magic Internet Money 🎩🐰 @mimcoin]

Come join in and talk with @Dexaran The man, the myth, the legend!!

https://t.co/N96qDTXdT3

[Dexaran @Dexaran]

@VectorBits Victim is not a contract, its just an address.

Victim contract is this one: 0xddbb864c2541e27152dbb87037ece852afb1faf5

The core mechanic of the attack was the exploitation of the `approval` of USDT.

The root of the issue: approvals are insecure.