Dexaran (@Dexaran) - โปรไฟล์ Twitter

ทวีตที่ปักหมุด

Dexaran@Dexaran·11 Kas

A user @qklpjeth just lost $25,000,000 because of a #ERC20 security flaw that I discovered and reported in 2017. #issuecomment-296711733" target="_blank" rel="nofollow noopener">github.com/ethereum/EIPs/… #ERC20 is an insecure standard. It lack transaction handling which makes error handling impossible. #ethereum @ethereum

English

7

15

64

11.5K

Dexaran@Dexaran·6 Mar

@VectorBits Victim is not a contract, its just an address. Victim contract is this one: 0xddbb864c2541e27152dbb87037ece852afb1faf5 The core mechanic of the attack was the exploitation of the `approval` of USDT. The root of the issue: approvals are insecure.

English

0

21

VectorBits@VectorBits·13 Şub

⚠️⚠️⚠️Alert Notic Attack Tx: etherscan.io/tx/0x54bb31a5a… Victim contract: 0x222E674FB1a7910cCF228f8aECF760508426b482 Attacker: 0x4Fd9669FB676EA2AcE620AFb6178aE300EcFd8a9 Attacker contract: 0xc8540A70Aa191651D7Cf8ED854eA3d346C897b2A Chain: Mainnet Loss: ~ $13k

English

2

0

5

2.9K

Hugo Montenegro@uwwgo·2 Şub

ERC-20 is the worst thing that ever happened to Ethereum. I hate it. I have had to built around it for years. Thus, I wrote a hit piece on ERC-20. Here's the TLDR on why the standard is terrible: 1.) You cannot attach information to a transfer This makes programmatically building logic on erc20 payments impossible. That's really dumb. 2.) approve(). Self-explanatory. 3.) ERC-20 and Ether are both "coins", but they are different. This is very very very confusing for normies and makes for horrible UX. Read my full hit piece on the worst standard in Ethereum history here: hugo0.com/blog/how-erc20…

English

39

12

138

33.8K

Dexaran@Dexaran·3 Şub

@uwwgo It's also straight up insecure. Violates "failsafe defaults" and "error handling" principles of secure software designing. Caused $100M+ losses: dexaran.github.io/erc20-losses/ Reported this to EF in 2017 #issuecomment-296711733" target="_blank" rel="nofollow noopener">github.com/ethereum/EIPs/… but they did nothing to solve it.

English

1

2

7

662

Dexaran รีทวีตแล้ว

rektkid@rektkid_·5 Ağu

The TLDR with EOS is that Yves appointed a Chinese anti decentralisation chancer to run Labs, and entered into 50/50 MSIGs over vast sums of network funds. The two are now at loggerheads, and that puts the chain in a pretty dire situation. Just shit leadership all round.

English

3

1

5

738

Dexaran รีทวีตแล้ว

Betoshi_Pt 🇵🇹 🇧🇷@Betoshi_Pt·20 Oca

📕ERC-223 🔹É um padrão de tokens na Ethereum. 🔹Melhora a segurança face ao ERC-20. 🔹Evita perder tokens enviados a contratos errados. 🔹Valida o destino antes de transferir os tokens.

Português

1

3

157

Dexaran@Dexaran·13 Ara

@0xDRick @uttam_singhk Yes, but there is no other way to allow existing ERC-20 tokens to become ERC-223. If we would need to create an upgrading procedure then it will lead to a situation where both standards will co-exist for some time and then a newer one will replace the older one.

English

0

59

Rick@0xDRick·13 Ara

@Dexaran @uttam_singhk What about contracts that already recognize/support existing Erc20? If users wrap their erc20 to erc223 it's gonna be a whole new "token". Existing contracts will treat them differently

English

1

0

67

Uttam@uttam_singhk·12 Ara

this is so f*cking scary - a txn made 9 months ago to transfer just $5 ended up causing a $30K loss. TLDR: → a txn was approved 9 months ago → to interact with the ThirdWeb Universal Bridge → Infinite approval was given (just for a $5 transfer) → a vulnerability in the contract was discovered in April → but the contract remained active onchain, including the blog referencing the affected contract address → vulnerability allowed anyone to drain funds from users with infinite approval → the hacker waited 9 months for the user to deposit a substantial amount → And boom - $30K gone in a single txn → funds were sent to Railgun, so can’t be traced → thirdWeb permanently disabled the legacy affected contract after the hack was disclosed → the blog referencing the affected (now-disabled) contract address is still live I don’t even know whom to blame here. It’s honestly a shame that after all these years of building, crypto users still have to deal with stuff like this and this user is literally one of the smartest people in the industry.

Jill Gunter ☕@jillgun

Last night around 5pm I sat down to do some work. I opened my Rabby wallet to try out Espresso's new cross-chain mint product, Presto, that Rarible had just put live on mainnet. When I opened my wallet, I immediately saw that $30k was missing...

English

130

69

733

230.6K

Dexaran@Dexaran·13 Ara

I've reported ERC-20 design flaws to those who worked on its finalization in 2017: #issuecomment-296711733" target="_blank" rel="nofollow noopener">github.com/ethereum/EIPs/… They ignored it for 8 years, now there are $100M lost because of the lack of transaction handling and billions lost because of approval-related problems: dexaran.github.io/erc20-losses They are silencing the issue, for example at Devcon7 they were just removing questions from live questions pool on record: youtube.com/shorts/KJCs4jC… Someone had to experience this as a wake up call to others << this is the result of Ethereum's censorship of the problem. They know about it since 2017. I personally warned them and they did nothing to protect users.

YouTube

English

0

1

26

Suky ⨀@sukywin·13 Ara

@NDIDI_GRAM @jillgun read the article yesterday and mass revoked all approvals on about 5 chains sad that someone had to experience this as a wake up call to others

English

2

0

327

HEADBOY 🦇🔊@NDIDI_GRAM·13 Ara

One simple mistake cost @jillgun $30k. Approval hacks and token drains are one of the major flaws in crypto, but the good news is that they can be avoided: 1- Manually Set Approval Limits Or Stop use Dex’s That Sets Infinite Approval: You can manually set the exact amount, you want to swap in your web browser rather than approving an unlimited amount. Look at my screenshot below. @Uniswap wants me to approve “115792089237316195423570985008687907853269984665640564039457584007913129.639935” for a $995 swap. If, by any chance, they get hacked, that’s the amount of money I’m risking losing simply because I used their DEX. Frame 2: @JumperExchange doesn’t allow you approve more than you spend, so if you frequently use jumper, you’re free from token approval drains or hack. So either manually set exact token approval or use a Dex that solves the error. 2- Revoke Transactions: One Key takeaway from @jillgun’s story is that the approval was done six months prior to drain, so there was enough time to manually revoke the token approval contracts. There are two ways around this: - @RevokeCash: Toolkit for revoke token approval contracts, so visit and max revoke all esp unlimited contracts. - @Rabby_io: Rabby has an in wallet feature that functions like revoke cash. You should be fine if you follow either of these two steps. Also, like and share if this was helpful. It could save a degen.

Jill Gunter ☕@jillgun

Last night around 5pm I sat down to do some work. I opened my Rabby wallet to try out Espresso's new cross-chain mint product, Presto, that Rarible had just put live on mainnet. When I opened my wallet, I immediately saw that $30k was missing...

English

52

12

200

16K

Dexaran@Dexaran·13 Ara

ERC-20 is insecure by design. owasp.org/Top10/2021/A04… It violates two of the most basic security principles: - Error handling is a must (there is no transaction handling which makes error handling impossible) - Secure defaults I've reported these problems in 2017 #issuecomment-296711733" target="_blank" rel="nofollow noopener">github.com/ethereum/EIPs/… and highlighted that it will result in financial damage to end users. The report was ignored for 8 years and now there are $100,000,000 lost because of the lack of transaction handling and billions lost because of approval-related problems (which are also a consequence of the lack of transaction handling): dexaran.github.io/erc20-losses Now @ethereum is censoring questions about this problems, for example they are blatantly removing questions from live presentation like this: youtube.com/shorts/KJCs4jC… Security researchers who never wrote that ERC-20 violates the most basic principles of secure software design - what are you even doing?

YouTube

English

0

1

64

Dexaran@Dexaran·13 Ara

No, the adoption is not happening because there is no coordination of an ecosystem upgrade. The real problem here is that @VitalikButerin is the author of ERC-20 eips.ethereum.org/EIPS/eip-20 and nobody is allowed to criticize it, also @ethereum is applying immense censorship wherever they can to silence the reports of ERC-20 problems. They are doing THIS instead of coordinating an ecosystem upgrade. - I was denied the opportunity to be a speaker on Devcon in 2024 and on Devconnect 2025 (yeah, they prefer to discuss North Korea hackers rather than real problems that cause $100M damage and can be solved) - Questions regarding ERC-20 problem and financial losses were removed from the live questions pool on record: youtube.com/shorts/KJCs4jC… - My reddit posts are never approved on r/ethereum, spoke to @poojaranjan19 and she told me "its spam protection, not censorship" I was involved in solving many security issues like 51%-attacks ecips.ethereumclassic.org/ECIPs/ecip-1092 in $ETC and the procedure is always the same: 1. Identify the problem 2. Reach an agreement amont participants about which solution should be used 3. Announce it 4. Reach out to mining pools / exchanges / block explorers / node operators - tell them that we need to do X to solve the problem 5. Provide technical assistance during the process I don't believe that @ethereum can coordinate an upgrade from POW to POS but it can't do the same to coordinate an upgrade from ERC-20 to ERC-223. I've developed ERC-7417: Token Converter for this purpose: eips.ethereum.org/EIPS/eip-7417 The idea is to follow the Wrapped Ether approach and create exactly one ERC-223 wrapper for each existing ERC-20 token so that users would be able to start converting their existing tokens to ERC-223 "versions" without any actions required from the token devs side. They can convert it back at any moment if its necessary.

YouTube

English

0

1

45

badadvicehq.base.eth@etcontradictio·13 Ara

I did a little research on ERC-223 and it sure looks like a game changer. It's always been crazy to me how smart contracts can easily be exploited. ERC-223 will ensure safety of assets during transfers. However, it seems the Immutability of contracts is the major reason adoption is not happening. My question to you @uttam_singhk is; how can this be addressed as painlessly as possible?

Uttam@uttam_singhk

this is so f*cking scary - a txn made 9 months ago to transfer just $5 ended up causing a $30K loss. TLDR: → a txn was approved 9 months ago → to interact with the ThirdWeb Universal Bridge → Infinite approval was given (just for a $5 transfer) → a vulnerability in the contract was discovered in April → but the contract remained active onchain, including the blog referencing the affected contract address → vulnerability allowed anyone to drain funds from users with infinite approval → the hacker waited 9 months for the user to deposit a substantial amount → And boom - $30K gone in a single txn → funds were sent to Railgun, so can’t be traced → thirdWeb permanently disabled the legacy affected contract after the hack was disclosed → the blog referencing the affected (now-disabled) contract address is still live I don’t even know whom to blame here. It’s honestly a shame that after all these years of building, crypto users still have to deal with stuff like this and this user is literally one of the smartest people in the industry.

English

2

0

1

75

Dexaran@Dexaran·13 Ara

There is ERC-7417: eips.ethereum.org/EIPS/eip-7417 It can "wrap" each existing ERC-20 token -> ERC-223 version 1:1 so users can start using ERC-223 tokens without the consent of the token developers ideally. It doesn't make sense if the user would need to sell these tokens on CEX and the CEX doesn't support ERC-223 deposits however. We're building dex223.io to enable trading for such tokens

English

1

0

4

152

Rick@0xDRick·13 Ara

@Dexaran @uttam_singhk Amazing work man. May I ask if it's hard for existing projects that already using ERC20 to switch to your ERC223 ? cuz I think it's not that because they don't notice the threat but it's because the migration have a chance to messed up the whole system

English

1

0

2

167

Dexaran@Dexaran·12 Ara

In defense of EOS - they did build a working technology stack which is superior to what Ethereum is even today. Their virtual machine is better, their smart-contracts have better performance and could be written in normal programming languages like C++ instead of home-brewed Solidity I've started the downtrend of EOS in 2019 when I've designed and executed an attack that froze its mainnet for a month web.archive.org/web/2021062307… DAPPs left it and never came back after that point if I'm correct and thats quite frustrating to see that the whole platform can fall victim of governance issues.

English

0

1

76

hantengri@hantengri·24 Kas

eos raised $4.2b (yes, billion) “ethereum on steroids” promised to kill ethereum couldn’t even kill 1 tps cardano more like ethereum on sedatives even the people who launched the project abandoned ship early and pivoted to other things raising this much money and contributing absolutely nothing to crypto should qualify as some kind of world record recently they rebranded into something called “web3 banking” (whatever that’s supposed to mean) their so called web3 bank (lmfaoo) holds $300m tvl on a dex nobody on this planet has ever heard of i don’t know how that’s even possible probably just because $4b is such an absurd amount of money they still haven’t managed to burn through it the truth is most of that money ended up funding another project anyway i genuinely don't believe even bots are using this place their social accounts just rt crypto news and post ai slop they even got a coinbase delist recently yet somehow it’s still sitting at a $400m fdv zero

hantengri@hantengri

0g labs raised $357m $250m of that is labeled as “token commitments” (whatever that even means) literally for nothing apparently the $75m from pre-seed and seed wasn’t enough, so they also did a $30m node sale node sale… basically just a fancy way of saying token sale last time I saw the founder, he was bribing kols to get to the top of the kaito leaderboard they’ve burned millions on this nonsense. not surprising when you have too much money and nothing to actually build it has basically zero activity; they just mint worthless nfts from time to time to pretend something’s happening it’s still sitting at a $1.2b fdv what the fuck does “ai l1” even mean anyway? zero

English

179

64

1K

338.6K

Dexaran@Dexaran·12 Ara

Approvals were introduced in ERC-20 as a weird quirk to bypass 1024-call-stack-depth bug of the EVM because the standard was proposed in 2015. In 2016 with Tangerine Whistle hardfork the 1024-call-stack-depth bug was fixed (and approvals became unnecessary). In 2017 I've designed ERC-223 standard that eliminates approvals and also warned those who were finalizing ERC-20 standard that its design will result in financial losses for Ethereum users. #issuecomment-1679275590" target="_blank" rel="nofollow noopener">github.com/ethereum/ether… Unfortunately these smart Ethereum guys keep using inherently insecure standard and nowadays $100,000,000 are lost because of the lack of transaction handling and billions are lost due to approval-related problems and scams: dexaran.github.io/erc20-losses/ Who would've thought that violating well-known security principles may result in lost money (except Dexaran who reported it 8 years ago)...

English

0

3

37

Erick@erickpinos·12 Ara

@uttam_singhk Never really understood why ERC20 approvals were a thing in the first place If smart contracts need access to your funds at a later time, isn’t that just a vault

English

1

0

1

281

Uttam@uttam_singhk·12 Ara

ERC20 approvals was one of the biggest ethereum's design mistakes imo & the community is still paying for it after all these years. yes, we have EIP-7702 now but let's be honest most of the people still have to go through force approvals. & the reality is this will take more time, even if there is hardfork to migrate EOAs to smart accounts, the legacy contracts, bridges, routers, and tooling all need to migrate too. I am not complaining ofc IK adoption takes time, it's only been what 7 months since pectra went live but we still have a long way to go...

Uttam@uttam_singhk

this is so f*cking scary - a txn made 9 months ago to transfer just $5 ended up causing a $30K loss. TLDR: → a txn was approved 9 months ago → to interact with the ThirdWeb Universal Bridge → Infinite approval was given (just for a $5 transfer) → a vulnerability in the contract was discovered in April → but the contract remained active onchain, including the blog referencing the affected contract address → vulnerability allowed anyone to drain funds from users with infinite approval → the hacker waited 9 months for the user to deposit a substantial amount → And boom - $30K gone in a single txn → funds were sent to Railgun, so can’t be traced → thirdWeb permanently disabled the legacy affected contract after the hack was disclosed → the blog referencing the affected (now-disabled) contract address is still live I don’t even know whom to blame here. It’s honestly a shame that after all these years of building, crypto users still have to deal with stuff like this and this user is literally one of the smartest people in the industry.

English

19

8

102

15.6K

Dexaran@Dexaran·12 Ara

1. Approvals were introduced as a weird quirk to address 1024-call-stack-depth bug of EVM in 2015 when ERC-20 was proposed. Since Tangerine Whistle hardfork in 2016 approvals became unnecessary: #issuecomment-1679275590" target="_blank" rel="nofollow noopener">github.com/ethereum/ether… 2. "Pull transacting method" is designed for credit cards and traditional financial instruments, not trustless assets like tokens. In trustless systems approving pattern introduces security problems medium.com/dex223/erc-20-… ...and results in financial damage to end users obviously. 3. Unlimited approvals are just a consequence of a greater problem - ERC-20 is designed in such a way that it violates standard software security principles and does not implement transaction handling in its default `transfer(..)` function. The standard must be designed in a different way so that `transfer(..)` function would notify the recipient of the transaction (just like native currency or NFTs work). In this case there would be no need for approvals and nobody would be asking for unlimited approvals.

English

0

2

39

kethic.eth@kethcode·12 Ara

@uttam_singhk approvals are fine. they work the same way other financial instruments do. they could have been implemented better but the concept is core and necessary. unlimited approvals are a crime and should never have existed.

English

1

0

5

323

Dexaran รีทวีตแล้ว

WPA 🇺🇸@warpaul·12 Ara

unpopular opinion of the day but @Dexaran is right @ethereum needs more intellectual honesty and less political alignment about its flaws few

Dexaran@Dexaran

ERC-20 is insecure by design. It violates two of the most basic security principles: - Error handling is a must (there is no transaction handling which makes error handling impossible) - Secure defaults > In ERC-20 the `transfer(..)` function is unhandleable >> devs need a way to deposit tokens to contracts >>> they implement another `approve(..) + transferFrom(..)` pattern to do so >>>>t hey leave `transfer(..)` unhandleable which makes the defaults of ERC-20 unsafe >>>>> approve + transferFrom incentivizes DAPP devs to ask for an unlimited approval since it makes UX and gas fees for their users better >>>>>> users lose money but everyone blames them for making mistakes.... completely ignoring the fact that the root of the problem is the design of the standard and there are dozens of security researchers who are supposed to be competent enough to identify this Whom to blame? - Every security researcher/auditor who didn't write that ERC-20 is an insecure standard. What are they even doing if they don't expose violations of the most basic security principles while pretending to be security experts? Hey @SEAL_911 how many articles have you written about the fact that ERC-20 violates well-known software security principles? What have you done in 8 years to PREVENT it? If you design a piece of software and it violates 2 out of 8 most basic security principles guess what? - People lose money. I've outlined it many times and even designed an alternative ERC-223 standard in 2017 to solve these problems and eliminate the need for approvals completely: medium.com/dex223/erc-20-… dexaran820.medium.com/security-probl… I've highlighted that ERC-20 design will inevitebly result in a loss of funds back during its finalization process #issuecomment-296711733" target="_blank" rel="nofollow noopener">github.com/ethereum/EIPs/… There were less than $20K at that momen. This problem report was ignored for 8 years and now there are more than $100,000,000 lost because of the lack of error handling and billions lost because of approval-related problems: dexaran.github.io/erc20-losses Regarding approvals in ERC-20 standard (explanation: #issuecomment-1679275590" target="_blank" rel="nofollow noopener">github.com/ethereum/ether…): - The standard was proposed in 2015, there was 1024-call-stack-depth bug in EVM. - Approve & transferFrom pattern was introduced to make tokens unaffected by this bug. It was not a smart design, it was a weird quirk to bypass bugs of EVM. - 1024-call-stack depth bug was fixed in 2016 and rendered approvals unnecessary. - In 2017 I proposed ERC-223 token standard which eliminates approvals completely.

English

8

12

167

29.9K

Dexaran@Dexaran·12 Ara

@zerohustletunez @jillgun Would be nice to connect. The problem here is that when people suffer from these issues - they are getting blamed for "making mistake" while in fact the standard needs to be replaced. If we can gather enough people who can voice the problem - things might change.

English

1

0

1

25

Tunezjr@zerohustletunez·12 Ara

@jillgun I saw a post from some @Dexaran guy last year on this but at this point I assume these are intentional because nobody paid cognizance to it. Been a victim too, but sadly I don’t have as loud a voice or as big a port. Sorry man

English

1

0

3

77

Jill Gunter ☕@jillgun·12 Ara

Last night around 5pm I sat down to do some work. I opened my Rabby wallet to try out Espresso's new cross-chain mint product, Presto, that Rarible had just put live on mainnet. When I opened my wallet, I immediately saw that $30k was missing...

Jill Gunter ☕@jillgun

The deep irony that as I sat here writing a defense of privacy in crypto to present in DC next week... my wallet was getting drained and the funds are getting deposited into Railgun.

English

221

114

939

567.5K

Dexaran@Dexaran·12 Ara

@tayvano_ Well-reasoned reply explained exactly why people lost $100M to well-known problems. Ethereum level of security this is.

English

1

0

98

Tay 💖@tayvano_·12 Ara

@Dexaran Ffs you’re such a absolute dick. You don’t give a single fuck about people except as far as they can confirm your existing biases and be used to push your bullshit. Stop fucking tagging me in your uselsss essays ever again. Especially when you’re lazy ambulance chasing.

English

1

0

98

Dexaran รีทวีตแล้ว

Dexaran@Dexaran·12 Ara

ERC-20 is insecure by design. It violates two of the most basic security principles: - Error handling is a must (there is no transaction handling which makes error handling impossible) - Secure defaults Whom to blame? - Every security researcher/auditor who didn't write that ERC-20 is an insecure standard. What are they even doing if they don't expose violations of the most basic security principles while pretending to be security experts? If you design a piece of software and it violates 2 out of 8 most basic security principles guess what? - People lose money. I've outlined it many times and even designed an alternative ERC-223 standard in 2017 to solve these problems and eliminate the need for approvals completely: medium.com/dex223/erc-20-… dexaran820.medium.com/security-probl… I've highlighted that ERC-20 design will inevitebly result in a loss of funds back during its finalization process #issuecomment-296711733" target="_blank" rel="nofollow noopener">github.com/ethereum/EIPs/… There were less than $20K at that momen. This problem report was ignored for 8 years and now there are more than $100,000,000 lost because of the lack of error handling and billions lost because of approval-related problems: dexaran.github.io/erc20-losses Regarding approvals in ERC-20 standard (#issuecomment-1679275590" target="_blank" rel="nofollow noopener">github.com/ethereum/ether…): - The standard was proposed in 2015, there was 1024-call-stack-depth bug in EVM. - Approve & transferFrom pattern was introduced to make tokens unaffected by this bug. It was not a smart design, it was a weird quirk to bypass bugs of EVM. - 1024-call-stack depth bug was fixed in 2016 and rendered approvals unnecessary. - In 2017 I proposed ERC-223 token standard which eliminates approvals completely. Hello @OpenZeppelin how about adding a warning about the problems of ERC-20 just as I suggested 3 years ago github.com/ethereum/ether…? Hello @TheSecureum @ChainSafeth how about writing an article to expose that ERC-20 violates well-known security principles, it is known for 8 years and people keep losing money because of that? Hello @_SamWilsn_ how about allowing security problems to be written directly to the texts of EIPs under "SECURITY CONSIDERATIONS" section to avoid obscuring the most egregious security violations like this one: #issuecomment-2197422911" target="_blank" rel="nofollow noopener">github.com/ethcatherders/…? I know EIP editors don't want to judge whether something is a security flaw or not but may be we can warn people about the most obvious design flaws that result in financil losses and avoid a situation when it is known for 8 years and people keep losing money next time?

English

6

15

98

8.7K

Dexaran@Dexaran·12 Ara

Ok, @tayvano_ @pcaversaccio @samczsun or @SEAL_911 can explain what happened. Thats nice. What's the result? Did you get your money back? - I assume you didn't. ERC-20 is an insecure standard, it violates well-known basic security principles: dexaran820.medium.com/security-probl… ERC-20 is insecure by design. How many articles have @tayvano_ @pcaversaccio @samczsun or @SEAL_911 written explaining that this standard is inherently unsafe and should be avoided? You're saying that they enable companies, and therefore the industry as a whole to safeguard itself - how successful this safeguarding is if we are using a standard which is insecure by design? How successful it is if they all know about its security flaws but instead of advocating for a better standard they are doing something else and you lose $30K in 2025 because of the security problem that I exposed in 2017 #issuecomment-296711733" target="_blank" rel="nofollow noopener">github.com/ethereum/EIPs/… ? Whats the level of security expertise of @SEAL_911 and all the above people if the industry as a whole suffers financial damage from security problems that were DISCOVERED, REPORTED and IGNORED for 8 years? I spoke to @tayvano_ about the ERC-20 issues here: - t.me/ETHSecurity/13… - t.me/ETHSecurity/13… She says "The problem is so complex to solve, nobody knows what to do" but is it really that hard to coordinate an ecosystem upgrade to solve a security problem which remains known for 8 years and keeps damaging Ethereum users over and over and over? Is it harder than coordinating an upgrade from POW to POS if @ethereum would step in? I'd like to ask those security experts two questions: - How many times did you declare that ERC-20 is insecure by design because it lacks transaction handling and its defaults are not fail-safe? - What have you done to facilitate the upgrade to a better standard if the currently used on is inherently insecure? They know that the problem exists for 8 years, I've personally disclosed and reported it, now its 2025 and people lost $100,000,000 because of the lack of transaction handling and billions because of approval-related problems: dexaran.github.io/erc20-losses But the root of the problem is very simple: if a standard violates well-known security practices - people lose money. Simple as that. You can't bandaid it, you need a secure standard instead.

English

1

2

362

Jill Gunter ☕@jillgun·12 Ara

@samczsun @SEAL_911 I didn't appreciate until that moment how incredible it is for anyone in this industry to be able to hop into a chat with the likes of @tayvano_ @pcaversaccio or @samczsun. This enables not only users, but companies, and therefore the industry as a whole to safeguard itself.

English

4

14

192

21.7K

Dexaran@Dexaran·12 Ara

ERC-20 is insecure by design. It violates two of the most basic security principles: - Error handling is a must (there is no transaction handling which makes error handling impossible) - Secure defaults > In ERC-20 the `transfer(..)` function is unhandleable >> devs need a way to deposit tokens to contracts >>> they implement another `approve(..) + transferFrom(..)` pattern to do so >>>>t hey leave `transfer(..)` unhandleable which makes the defaults of ERC-20 unsafe >>>>> approve + transferFrom incentivizes DAPP devs to ask for an unlimited approval since it makes UX and gas fees for their users better >>>>>> users lose money but everyone blames them for making mistakes.... completely ignoring the fact that the root of the problem is the design of the standard and there are dozens of security researchers who are supposed to be competent enough to identify this Whom to blame? - Every security researcher/auditor who didn't write that ERC-20 is an insecure standard. What are they even doing if they don't expose violations of the most basic security principles while pretending to be security experts? Hey @SEAL_911 how many articles have you written about the fact that ERC-20 violates well-known software security principles? What have you done in 8 years to PREVENT it? If you design a piece of software and it violates 2 out of 8 most basic security principles guess what? - People lose money. I've outlined it many times and even designed an alternative ERC-223 standard in 2017 to solve these problems and eliminate the need for approvals completely: medium.com/dex223/erc-20-… dexaran820.medium.com/security-probl… I've highlighted that ERC-20 design will inevitebly result in a loss of funds back during its finalization process #issuecomment-296711733" target="_blank" rel="nofollow noopener">github.com/ethereum/EIPs/… There were less than $20K at that momen. This problem report was ignored for 8 years and now there are more than $100,000,000 lost because of the lack of error handling and billions lost because of approval-related problems: dexaran.github.io/erc20-losses Regarding approvals in ERC-20 standard (explanation: #issuecomment-1679275590" target="_blank" rel="nofollow noopener">github.com/ethereum/ether…): - The standard was proposed in 2015, there was 1024-call-stack-depth bug in EVM. - Approve & transferFrom pattern was introduced to make tokens unaffected by this bug. It was not a smart design, it was a weird quirk to bypass bugs of EVM. - 1024-call-stack depth bug was fixed in 2016 and rendered approvals unnecessary. - In 2017 I proposed ERC-223 token standard which eliminates approvals completely.

English

5

4

44

9.1K

Dexaran

ค้นพบ