{"id":15930743,"url":"https://github.com/sripwoud/demo-failed-erc20-hack","last_synced_at":"2026-03-04T06:03:40.163Z","repository":{"id":104840928,"uuid":"498242296","full_name":"sripwoud/demo-failed-erc20-hack","owner":"sripwoud","description":"Example of a (failed) scam ERC20","archived":false,"fork":false,"pushed_at":"2024-02-11T17:05:30.000Z","size":75,"stargazers_count":5,"open_issues_count":0,"forks_count":1,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-02-26T11:47:03.083Z","etag":null,"topics":["erc20","ethereum","hack","hardhat","scam","solidity"],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"agpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sripwoud.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2022-05-31T08:03:31.000Z","updated_at":"2023-02-10T19:04:20.000Z","dependencies_parsed_at":"2023-07-03T01:45:52.933Z","dependency_job_id":null,"html_url":"https://github.com/sripwoud/demo-failed-erc20-hack","commit_stats":null,"previous_names":["sripwoud/demo-failed-erc20-hack"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/sripwoud/demo-failed-erc20-hack","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sripwoud%2Fdemo-failed-erc20-hack","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sripwoud%2Fdemo-failed-erc20-hack/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sripwoud%2Fdemo-failed-erc20-hack/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sripwoud%2Fdemo-failed-erc20-hack/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sripwoud","download_url":"https://codeload.github.com/sripwoud/demo-failed-erc20-hack/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sripwoud%2Fdemo-failed-erc20-hack/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":30073705,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-03-04T05:31:57.858Z","status":"ssl_error","status_checked_at":"2026-03-04T05:31:38.462Z","response_time":59,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["erc20","ethereum","hack","hardhat","scam","solidity"],"created_at":"2024-10-07T01:00:45.675Z","updated_at":"2026-03-04T06:03:40.148Z","avatar_url":"https://github.com/sripwoud.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Failed ERC20 hack Demo\nUnknown ERC20 contracts can potentially perform any actions within function that match the standard ERC20 interface (ABI).\n\n## Scam 1\nA common source of hack comes from the use of delegatecalls that allow a target contract (the one we \"delegate\" to), to\nexecute in the caller's context and especially modifies its storage.\n\n\u003cimg src=https://miro.medium.com/max/1400/1*4OB3IwTF1AkW6zH3tJv8Tw.png width=500 /\u003e\n\u003cimg src=https://miro.medium.com/max/2000/1*907YyYjEuAZCeLT9XiOA7A.png width=500 /\u003e\n\nOne could then think that it is possible for a contract to hide an approve within another by:\n- deploying a scam ERC20 that matches the standard ABI\n- overriding the approve function and delegatecall (to forward the right `msg.sender``) to a victim ERC20 contract to approve it\n\nThis doesn't work as the allowances in the caller contract (the scam contract) will be modified instead of the victim's.  \nSo the hack will have no effect. (See [test case](https://github.com/r1oga/demo-failed-erc20-hack/blob/df18ed55e0953f52c2be783e8d311a7d1d9bf3e8/test/scams.js#L44))\n\n## Scam 2 - Scam 3\nPerforming native ETH `send`/`transfer` within other functions calls.\nThis doesn't work either. It is not possible to override `nonpayable` (defined in the parent contract without `payable`) functions\nwith the `payable` modifier.\nThe solidity contracts won't compile.\n\nTry uncommenting the `transfer` function in [`Scam2.sol`](https://github.com/r1oga/demo-failed-erc20-hack/blob/df18ed55e0953f52c2be783e8d311a7d1d9bf3e8/contracts/Scam2.sol#L11) and [`Scam3.sol`](https://github.com/r1oga/demo-failed-erc20-hack/blob/df18ed55e0953f52c2be783e8d311a7d1d9bf3e8/contracts/Scam3.sol#L12) and run `yarn hardhat compile`. It will fail with errors like:\n```\nTypeError: Overriding function changes state mutability from \"nonpayable\" to \"payable\".\n```\n\n## Scam 4 - forcing out of gas error\nPossible. But is not benefiting anyone. Not even the person who deployed the scam contract...\n\n## Scam 5 - stealing ETH within a token transfer\nHide an ETH send in a token transfer.  \nThe function signature is still compliant to the standard: `transfer(address to, uint256 amount)`, but the function is made payable.  \nSo it is possible to steal ETH **provided there is ETH value sent when broadcasting the tx**. Otherwise there is nothing to steal. **Who builds the tx controls whether ETH is send or not.**\n\n### Tests\n\n```shell\nyarn\nyarn hardhat test\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsripwoud%2Fdemo-failed-erc20-hack","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsripwoud%2Fdemo-failed-erc20-hack","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsripwoud%2Fdemo-failed-erc20-hack/lists"}