3 ms·

This isn’t how it works. With ERC20 you “approve” tokens. That allows the specific contract you approve to spend up to a specific tokens at that specific addres

This isn’t how it works. With ERC20 you “approve” tokens. That allows the specific contract you approve to spend up to a specific tokens at that specific address. Things that a random smart contract cannot do: 1) Spend more tokens than the amount you approved. 2) Spend any other tokens besides the specific type that you approved. (E.g. can’t steal your NFT or USDC) 3) Spend tokens at any other wallet address even if you own those other addresses (and creating a new address for a specific purpose is trivially easy) In addition the only approve() technology is already being replaced with the modern EIP-2612 standard. (USDC already implements it.) In this workflow instead of pre-approving a contract, you sign a specific transaction-specific message. With EIP-2612 you know exactly how much you’re spending on each transaction and there’s zero after the fact risk.

betwixthewires 5y ago
I'm very much aware of how ERC20 contracts work, I've written them. I'm glad the standard for approval of control of wallets is being deprecated for one with more granularity and security, and I hope it solves this problem. But that is how it works. The idea that I have a wallet as an extension in my web browser, and people can deliver me any transaction they like, with a "yes" button decorated however they like in the form of a web app, it absolutely does mean that I need to know how to read solidity to be safe and that I must audit every transaction I'm interested in signing. And an engineer would take that for granted, but if that's the standard UX, again, this isn't ready for grandma, not even close. What ethereum should've done was be a little more slow moving with adding features and maintain mist so that a standard UI feature set could be expected by users.
pests 5y ago
Thank you, I was going to explain this. I have seen contracts approve your entire supply though without mentioning it. That would allow the contract to come back at any time, with no user action, to take more coins out. Just be wary of "Approving" contracts before using them on DeFi apps. That first approval confirmation is the most important as you're basically handing them that much coin and trusting them to give it all back.

betwixthewires 5y ago

I'm very much aware of how ERC20 contracts work, I've written them. I'm glad the standard for approval of control of wallets is being deprecated for one with more granularity and security, and I hope it solves this problem. But that is how it works. The idea that I have a wallet as an extension in my web browser, and people can deliver me any transaction they like, with a "yes" button decorated however they like in the form of a web app, it absolutely does mean that I need to know how to read solidity to be safe and that I must audit every transaction I'm interested in signing. And an engineer would take that for granted, but if that's the standard UX, again, this isn't ready for grandma, not even close. What ethereum should've done was be a little more slow moving with adding features and maintain mist so that a standard UI feature set could be expected by users.

pests 5y ago

Thank you, I was going to explain this. I have seen contracts approve your entire supply though without mentioning it. That would allow the contract to come back at any time, with no user action, to take more coins out. Just be wary of "Approving" contracts before using them on DeFi apps. That first approval confirmation is the most important as you're basically handing them that much coin and trusting them to give it all back.