Dexaran

#Pseudonymous smartcontract developer & security engineer

Founder of EthereumCommonwealth & of #ERC223

[Dexaran @Dexaran]

A user @qklpjeth just lost $25,000,000 because of a #ERC20 security flaw that I discovered and reported in 2017.

https://t.co/Sz8qU1pNrd

#ERC20 is an insecure standard. It lack transaction handling which makes error handling impossible.

#ethereum @ethereum

[DEX223 @Dex_223]

1/ Ethereum needs better token standards🚨

ERC-20 standard is poorly designed and outdated but it’s still the MOST adopted one.

What are its problems and why is it designed the way it is? 👇

[Magic Internet Money 🎩🐰 @mimcoin]

Come join in and talk with @Dexaran The man, the myth, the legend!!

https://t.co/N96qDTXdT3

[Dexaran @Dexaran]

@VectorBits Victim is not a contract, its just an address.

Victim contract is this one: 0xddbb864c2541e27152dbb87037ece852afb1faf5

The core mechanic of the attack was the exploitation of the `approval` of USDT.

The root of the issue: approvals are insecure.

[Hugo Montenegro @uwwgo]

ERC-20 is the worst thing that ever happened to Ethereum. I hate it. I have had to built around it for years.

Thus, I wrote a hit piece on ERC-20.

Here's the TLDR on why the standard is terrible:

1.) You cannot attach information to a transfer
This makes programmatically building logic on erc20 payments impossible. That's really dumb.

2.) approve(). Self-explanatory.

3.) ERC-20 and Ether are both "coins", but they are different. This is very very very confusing for normies and makes for horrible UX.

Read my full hit piece on the worst standard in Ethereum history here: https://t.co/l4HbCNAohP

[Dexaran @Dexaran]

@uwwgo It's also straight up insecure. Violates "failsafe defaults" and "error handling" principles of secure software designing.

Caused $100M+ losses: https://t.co/7ocZpbACvf

Reported this to EF in 2017 https://t.co/Sz8qU1pNrd but they did nothing to solve it.

[rektkid @rektkid_]

The TLDR with EOS is that Yves appointed a Chinese anti decentralisation chancer to run Labs, and entered into 50/50 MSIGs over vast sums of network funds. The two are now at loggerheads, and that puts the chain in a pretty dire situation.

Just shit leadership all round.

[Betoshi_Pt 🇵🇹 🇧🇷 @Betoshi_Pt]

📕ERC-223

🔹É um padrão de tokens na Ethereum.
🔹Melhora a segurança face ao ERC-20.

🔹Evita perder tokens enviados a contratos errados.
🔹Valida o destino antes de transferir os tokens.

[Dexaran @Dexaran]

@0xDRick @uttam_singhk Yes, but there is no other way to allow existing ERC-20 tokens to become ERC-223.

If we would need to create an upgrading procedure then it will lead to a situation where both standards will co-exist for some time and then a newer one will replace the older one.

[Dexaran @Dexaran]

I've reported ERC-20 design flaws to those who worked on its finalization in 2017: https://t.co/FhNvUHEEKs

They ignored it for 8 years, now there are $100M lost because of the lack of transaction handling and billions lost because of approval-related problems: https://t.co/Ev5nCVjHAe

They are silencing the issue, for example at Devcon7 they were just removing questions from live questions pool on record: https://t.co/XkkHWOnOF7

Someone had to experience this as a wake up call to others << this is the result of Ethereum's censorship of the problem. They know about it since 2017. I personally warned them and they did nothing to protect users.

[Dexaran @Dexaran]

ERC-20 is insecure by design.

https://t.co/syFheBmxQZ

It violates two of the most basic security principles:

- Error handling is a must (there is no transaction handling which makes error handling impossible)

- Secure defaults

I've reported these problems in 2017 https://t.co/FhNvUHEEKs and highlighted that it will result in financial damage to end users.

The report was ignored for 8 years and now there are $100,000,000 lost because of the lack of transaction handling and billions lost because of approval-related problems (which are also a consequence of the lack of transaction handling): https://t.co/Ev5nCVjHAe

Now @ethereum is censoring questions about this problems, for example they are blatantly removing questions from live presentation like this: https://t.co/XkkHWOnOF7

Security researchers who never wrote that ERC-20 violates the most basic principles of secure software design - what are you even doing?

[Dexaran @Dexaran]

No, the adoption is not happening because there is no coordination of an ecosystem upgrade.

The real problem here is that @VitalikButerin is the author of ERC-20 https://t.co/lgJ20dV1Up and nobody is allowed to criticize it, also @ethereum is applying immense censorship wherever they can to silence the reports of ERC-20 problems. They are doing THIS instead of coordinating an ecosystem upgrade.

- I was denied the opportunity to be a speaker on Devcon in 2024 and on Devconnect 2025 (yeah, they prefer to discuss North Korea hackers rather than real problems that cause $100M damage and can be solved)
- Questions regarding ERC-20 problem and financial losses were removed from the live questions pool on record: https://t.co/XkkHWOnOF7
- My reddit posts are never approved on r/ethereum, spoke to @poojaranjan19 and she told me "its spam protection, not censorship"

I was involved in solving many security issues like 51%-attacks https://t.co/tus0bQvwOt in $ETC and the procedure is always the same:

1. Identify the problem
2. Reach an agreement amont participants about which solution should be used
3. Announce it
4. Reach out to mining pools / exchanges / block explorers / node operators - tell them that we need to do X to solve the problem
5. Provide technical assistance during the process

I don't believe that @ethereum can coordinate an upgrade from POW to POS but it can't do the same to coordinate an upgrade from ERC-20 to ERC-223.

I've developed ERC-7417: Token Converter for this purpose: https://t.co/cCQJTAtNdG

The idea is to follow the Wrapped Ether approach and create exactly one ERC-223 wrapper for each existing ERC-20 token so that users would be able to start converting their existing tokens to ERC-223 "versions" without any actions required from the token devs side. They can convert it back at any moment if its necessary.

[Dexaran @Dexaran]

There is ERC-7417: https://t.co/cCQJTAtNdG

It can "wrap" each existing ERC-20 token -> ERC-223 version 1:1 so users can start using ERC-223 tokens without the consent of the token developers ideally.

It doesn't make sense if the user would need to sell these tokens on CEX and the CEX doesn't support ERC-223 deposits however.

We're building https://t.co/C34gBhx4wl to enable trading for such tokens

[Dexaran @Dexaran]

In defense of EOS - they did build a working technology stack which is superior to what Ethereum is even today.

Their virtual machine is better, their smart-contracts have better performance and could be written in normal programming languages like C++ instead of home-brewed Solidity

I've started the downtrend of EOS in 2019 when I've designed and executed an attack that froze its mainnet for a month https://t.co/wCsvk2HIVd

DAPPs left it and never came back after that point if I'm correct and thats quite frustrating to see that the whole platform can fall victim of governance issues.

[Dexaran @Dexaran]

Approvals were introduced in ERC-20 as a weird quirk to bypass 1024-call-stack-depth bug of the EVM because the standard was proposed in 2015.

In 2016 with Tangerine Whistle hardfork the 1024-call-stack-depth bug was fixed (and approvals became unnecessary).

In 2017 I've designed ERC-223 standard that eliminates approvals and also warned those who were finalizing ERC-20 standard that its design will result in financial losses for Ethereum users.

https://t.co/I1Mcdo5I4y

Unfortunately these smart Ethereum guys keep using inherently insecure standard and nowadays $100,000,000 are lost because of the lack of transaction handling and billions are lost due to approval-related problems and scams: https://t.co/aGgwtWv2ds

Who would've thought that violating well-known security principles may result in lost money (except Dexaran who reported it 8 years ago)...

[Dexaran @Dexaran]

1. Approvals were introduced as a weird quirk to address 1024-call-stack-depth bug of EVM in 2015 when ERC-20 was proposed. Since Tangerine Whistle hardfork in 2016 approvals became unnecessary: https://t.co/I1Mcdo6fU6

2. "Pull transacting method" is designed for credit cards and traditional financial instruments, not trustless assets like tokens. In trustless systems approving pattern introduces security problems https://t.co/s41XbLog9U

...and results in financial damage to end users obviously.

3. Unlimited approvals are just a consequence of a greater problem - ERC-20 is designed in such a way that it violates standard software security principles and does not implement transaction handling in its default `transfer(..)` function.

The standard must be designed in a different way so that `transfer(..)` function would notify the recipient of the transaction (just like native currency or NFTs work). In this case there would be no need for approvals and nobody would be asking for unlimited approvals.

[WPA 🇺🇸 @warpaul]

unpopular opinion of the day

but @Dexaran is right

@ethereum needs more intellectual honesty and less political alignment

about its flaws

few

[Dexaran @Dexaran]

@zerohustletunez @jillgun Would be nice to connect. The problem here is that when people suffer from these issues - they are getting blamed for "making mistake" while in fact the standard needs to be replaced.

If we can gather enough people who can voice the problem - things might change.

[Dexaran @Dexaran]

@tayvano_ Well-reasoned reply explained exactly why people lost $100M to well-known problems.

Ethereum level of security this is.

[Dexaran @Dexaran]

ERC-20 is insecure by design.

It violates two of the most basic security principles:

- Error handling is a must (there is no transaction handling which makes error handling impossible)
- Secure defaults

Whom to blame? - Every security researcher/auditor who didn't write that ERC-20 is an insecure standard.

What are they even doing if they don't expose violations of the most basic security principles while pretending to be security experts?

If you design a piece of software and it violates 2 out of 8 most basic security principles guess what? - People lose money.

I've outlined it many times and even designed an alternative ERC-223 standard in 2017 to solve these problems and eliminate the need for approvals completely:

https://t.co/s41XbLnIkm

https://t.co/21ZXLwVYMh

I've highlighted that ERC-20 design will inevitebly result in a loss of funds back during its finalization process https://t.co/FhNvUHEEKs

There were less than $20K at that momen. This problem report was ignored for 8 years and now there are more than $100,000,000 lost because of the lack of error handling and billions lost because of approval-related problems: https://t.co/rnuaMcNC86

Regarding approvals in ERC-20 standard (https://t.co/I1Mcdo5I4y):

- The standard was proposed in 2015, there was 1024-call-stack-depth bug in EVM.
- Approve & transferFrom pattern was introduced to make tokens unaffected by this bug. It was not a smart design, it was a weird quirk to bypass bugs of EVM.
- 1024-call-stack depth bug was fixed in 2016 and rendered approvals unnecessary.
- In 2017 I proposed ERC-223 token standard which eliminates approvals completely.

Hello @OpenZeppelin how about adding a warning about the problems of ERC-20 just as I suggested 3 years ago https://t.co/IRtVFvtNOy?

Hello @TheSecureum @ChainSafeth how about writing an article to expose that ERC-20 violates well-known security principles, it is known for 8 years and people keep losing money because of that?

Hello @_SamWilsn_ how about allowing security problems to be written directly to the texts of EIPs under "SECURITY CONSIDERATIONS" section to avoid obscuring the most egregious security violations like this one: https://t.co/yZSwFAJcf5? I know EIP editors don't want to judge whether something is a security flaw or not but may be we can warn people about the most obvious design flaws that result in financil losses and avoid a situation when it is known for 8 years and people keep losing money next time?

[Dexaran @Dexaran]

Ok, @tayvano_ @pcaversaccio @samczsun or @SEAL_911 can explain what happened. Thats nice.

What's the result? Did you get your money back?
- I assume you didn't.

ERC-20 is an insecure standard, it violates well-known basic security principles: https://t.co/21ZXLwVYMh

ERC-20 is insecure by design.

How many articles have @tayvano_ @pcaversaccio @samczsun or @SEAL_911 written explaining that this standard is inherently unsafe and should be avoided?

You're saying that they enable companies, and therefore the industry as a whole to safeguard itself - how successful this safeguarding is if we are using a standard which is insecure by design?

How successful it is if they all know about its security flaws but instead of advocating for a better standard they are doing something else and you lose $30K in 2025 because of the security problem that I exposed in 2017 https://t.co/FhNvUHEEKs ?

Whats the level of security expertise of @SEAL_911 and all the above people if the industry as a whole suffers financial damage from security problems that were DISCOVERED, REPORTED and IGNORED for 8 years?

I spoke to @tayvano_ about the ERC-20 issues here:

- https://t.co/55HhlE1GqY

- https://t.co/isYNKs1uoj

She says "The problem is so complex to solve, nobody knows what to do" but is it really that hard to coordinate an ecosystem upgrade to solve a security problem which remains known for 8 years and keeps damaging Ethereum users over and over and over? Is it harder than coordinating an upgrade from POW to POS if @ethereum would step in?

I'd like to ask those security experts two questions:

- How many times did you declare that ERC-20 is insecure by design because it lacks transaction handling and its defaults are not fail-safe?

- What have you done to facilitate the upgrade to a better standard if the currently used on is inherently insecure?

They know that the problem exists for 8 years, I've personally disclosed and reported it, now its 2025 and people lost $100,000,000 because of the lack of transaction handling and billions because of approval-related problems: https://t.co/Ev5nCVjHAe

But the root of the problem is very simple: if a standard violates well-known security practices - people lose money. Simple as that. You can't bandaid it, you need a secure standard instead.