4 ms·
> One example is to airdrop a backdoored token, and when the user tries to move it they wind up authorizing movement of their other valuable tokens. Do you hav
by legutierr 5y ago
> One example is to airdrop a backdoored token, and when the user tries to move it they wind up authorizing movement of their other valuable tokens.
Do you have an example of where something like this was actually deployed? How would a user moving one token would result in another token being moved?
I can only imagine a situation where a user might be induced to install a compromised wallet, and then to give that wallet keys to the their account. But this is not an attack strategy that depends on there being a "backdoored token" of any kind.
Is there some way to code an ERC20 token that would somehow give you access to a user's other tokens?
- vmception 5y agoTo me this is like asking if I have an example of a phishing site, not off the top of my head? Just embed approval methods for a predefined external token contract address into the transfer() method of the airdropped token Then you can also chain the transfer within it or you can wait and transfer them all yourself Doing too much in one transaction will alert more users because the gas price will be unexpectedly large
- legutierr 5y agoAh, am I right that you are referring to something similar to what is discussed in this article? https://blocksecteam.medium.com/unlimited-approval-in-erc20-convenience-or-security-1c8dce421ed7 https://blocksecteam.medium.com/unlimited-approval-in-erc20-... But is it not the case that the approve() method must be invoked directly by the sender (i.e. by the account that holds the tokens that are the target of the theft)? Wouldn’t the invocation be rejected by the ERC20 token if it is made indirectly, i.e. if the invocation were made from within another method (provided that the target ERC20 token is coded properly)?