Your protocol launches. Everything passes the test suite with 100% coverage. Your audits are clean.
Then, an unexpected token enters your liquidity pool. The accounting drifts by a fraction of a percent. Within hours, the discrepancy compounds. Users attempt to withdraw, and the transactions revert. The vault is permanently bricked, and funds are stuck.
What went wrong?
Most ERC20 exploits are not actually bugs in the protocol's core logic. They happen because protocol engineers assume every token behaves exactly like a vanilla OpenZeppelin implementation.
The ERC20 standard is an interface, not a guarantee. It defines function signatures (transfer, approve, balanceOf), but it dictates absolutely nothing about the internal execution logic behind those signatures.
If your protocol integrates arbitrary tokens, your threat model immediately includes the behavior of those tokens. A single flawed assumption about how a token transfers, reverts, or accounts for balances can lead to systemic insolvency.
Let's look under the hood of the most common ERC20 edge cases that break production systems, and how to engineer defensive architectures to mitigate them.
The Four Assumptions That Break Integrations
Before we look at specific edge cases, it helps to build a mental model of why these failures happen. Almost every ERC20 integration bug stems from one of four flawed assumptions:
- Amount Assumptions: Believing the amount you request to transfer is the exact amount that will arrive.
- Execution Assumptions: Assuming token transfers are passive state updates, rather than active execution environments.
- Permission Assumptions: Believing that having a sufficient balance and allowance guarantees a transfer will succeed.
- Accounting Assumptions: Hardcoding precision logic or assuming token behavior is immutable.
Let's break down how these assumptions fail in production.
Edge Case #1: Fee-on-Transfer & Rebasing Tokens
The assumption
If I call token.transferFrom(alice, vault, 100), the vault's balance increases by exactly 100.
What actually happens
Tokens can deduct a tax on transfer (e.g., a 5% protocol fee) or continuously alter user balances algorithmically (rebasing).
Example failure
A user deposits 100 fee-on-transfer tokens. The token takes a 5% fee.
User calls deposit(100)
👇
Token executes transfer, deducts 5% tax
👇
Vault receives 95 tokens
❌ Vault internally mints 100 shares based on 'amount' parameter
✅ Vault should mint 95 shares based on actual received funds
Because the vault blindly minted 100 shares, the user can immediately withdraw 100 tokens, successfully stealing 5 tokens from previous depositors. The accounting drifts, and the last users to withdraw will be left with nothing.
Mitigation
Never trust the amount parameter for internal accounting. Always measure the actual balance delta before and after the transfer.
uint256 balanceBefore = token.balanceOf(address(this));
token.safeTransferFrom(msg.sender, address(this), amount);
uint256 balanceReceived = token.balanceOf(address(this)) - balanceBefore;
// Use balanceReceived for all subsequent logic, never 'amount'
_mintShares(msg.sender, balanceReceived);
Takeaway: Balance-delta accounting fixes this assumption. Unfortunately, the next edge case breaks protocols even when the balances match perfectly.
Edge Case #2: Tokens with Callbacks (ERC-777 & Transfer Hooks)
The assumption
Calling transfer only updates storage balances and returns execution flow directly back to my contract.
What actually happens
Standards like ERC-777, or custom tokens with transfer hooks, actively hand execution control back to the sender or receiver via external calls during the transfer process.
Example failure
Your protocol updates the user's internal debt balance after pushing tokens to them.
User calls withdraw()
👇
Protocol calls token.transfer(user)
👇
Token calls back to User's smart contract
👇
User's contract calls withdraw() AGAIN (before protocol debt is updated)
This is a classic reentrancy attack, facilitated entirely by the token's internal hook.
Why This Surprises Engineers: We naturally view tokens as passive data ledgers. Callbacks turn tokens into active, hostile execution environments.
Mitigation
Follow the Checks-Effects-Interactions (CEI) pattern religiously. Update all internal state before interacting with external tokens. Additionally, apply OpenZeppelin's ReentrancyGuard (nonReentrant modifier) to any function interacting with external tokens.
Takeaway: Reentrancy guards handle unexpected execution paths. But what happens when a token quietly fails without telling you?
Edge Case #3: Returning false vs. Reverting
The assumption
If a token transfer fails, the transaction will revert.
What actually happens
Some older tokens (like ZRX) do not revert on failure. Instead, they gracefully return a false boolean.
Example failure
Your protocol calls token.transfer(user, amount)and doesn't check the return value. The transfer fails (returns false), but your code continues executing. The protocol marks the user's debt as paid, even though no tokens actually moved.
Mitigation
Never use bare transfer or transferFrom calls. Wrap them in logic that asserts the boolean return value is true.
OpenZeppelin / best practice
Always use OpenZeppelin's SafeERC20 library (safeTransfer, safeTransferFrom). It normalizes behavior by forcing a silent false failure to revert.
Takeaway: SafeERC20 forces silent failures to revert. But occasionally, you actually want certain transfers to bypass reverts.
Edge Case #4: Zero Address & Zero Amount Reverts
The assumption
Transferring an amount of 0 is a harmless No-Op (no operation) that costs a little gas but executes successfully.
What actually happens
Different token implementations handle zeros differently. Some explicitly revert if the transferred amount is 0, or if the target is the zero address.
Imagine this scenario:
Your protocol distributes daily yields in a batch loop to 100 users. One user earned 0 yield today. The loop attempts to transfer(user, 0). The token reverts, crashing the entire transaction and preventing the other 99 users from receiving their yields.
Mitigation
Standardize behavior by wrapping transfers in a simple defensive check to bypass zero-amount logic.
if (amount > 0) {
token.safeTransfer(user, amount);
}
Takeaway: Standardizing behavior protects your loops. But what if the token completely breaks the standard interface?
Edge Case #5: Missing Return Values (The USDT Problem)
The assumption
All ERC20 tokens return a boolean, as dictated by the standard interface.
Production Reality: Tether (USDT) on Ethereum Mainnet is non-standard. Its transfer, transferFrom, and approve functions do not return a boolean; they return void.
Example failure
If your contract compiles against the standard IERC20 interface, the EVM expects boolean return data to decode.
Standard: function transfer(...) returns (bool)
USDT: function transfer(...) [returns void]
EVM: "Wait, where is the boolean to decode? Revert."
Your protocol completely fails to integrate with the largest stablecoin on the market.
Mitigation
OpenZeppelin's SafeERC20 handles this under the hood. By using safeTransfer, you safely abstract away the missing return value issue at the assembly level.
Takeaway: SafeERC20 handles legacy interfaces. But interface compatibility won't save you from centralized control.
Edge Case #6: Blacklisted Addresses
The assumption
If an address has a sufficient balance and allowance, a transfer will always succeed.
What actually happens
Fiat-backed stablecoins like USDC and USDT maintain centralized blacklists. If an address is blacklisted, all transfers involving that address will revert.
Example failure
Your protocol liquidates undercollateralized debt. To close a position, it must send leftover USDC collateral to the user. The user gets blacklisted by Circle. The liquidation transaction reverts when attempting to send the leftover funds, preventing the protocol from clearing bad debt. The systemic risk cascades, threatening protocol solvency.
Design Rule: Pull-over-Push
Decouple protocol logic from token transfers. Instead of pushing funds to a user during a critical state change, record their balance internally and force them to pull (claim) it in a separate transaction.
Takeaway: Decoupling logic prevents centralized blacklists from freezing your protocol. Speaking of centralized quirks, let's look at approvals.
Edge Case #7: Non-Zero Approval Restrictions
The assumption
You can update an allowance from any number to any other number using approve(spender, newAmount).
What actually happens
To prevent approval front-running (where an attacker exploits an old allowance while a new one is pending), tokens like USDT require that allowances be reset to 0 before being updated to a new non-zero value.
Example failure
A router contract tries to update its USDT approval to a DEX from 50 to 100. It calls approve(dex, 100). Because the current allowance is 50 (non-zero), USDT reverts the transaction.
Mitigation
You must approve 0 before approving the target amount. In OpenZeppelin v5+, safeApprove was removed. Use forceApprove(), which natively handles the 0 reset under the hood.
Takeaway: Approval races are tricky, but at least the token is always the token... right?
Edge Case #8: Multiple Addresses for the Same Token
Mental Model: Think of an ERC20 token as a ledger. Usually, there is one door to access that ledger. But sometimes, developers build multiple doors (proxies, wrappers, aliases) that lead to the exact same ledger.
What actually happens
Some tokens (like older TrueUSD implementations) use multiple entry point addresses that point to the same underlying state.
Example failure
A lending protocol relies on the token's contract address as a unique identifier for price feeds. An attacker uses a wrapper contract that proxies to the same underlying token. The protocol reads the proxy as an unverified token, misprices the collateral, and allows the attacker to borrow against manipulated values.
Mitigation
Identify tokens strictly by exact, whitelisted addresses. Never rely blindly on msg.sender to dynamically determine asset identity.
Takeaway: Identity is fluid. And worse, token logic is mutable.
Edge Case #9: Upgradeable Tokens
The assumption
The token behavior I test today will be the token behavior in production tomorrow.
What actually happens
Tokens like USDC are upgradeable behind a proxy. The controlling entity can push an upgrade at any time, adding transfer fees, callbacks, or entirely new operational restrictions.
Example failure
You build a protocol assuming USDC has no fee-on-transfer. Circle upgrades USDC to enforce a 1 basis point transaction fee. Your static accounting breaks, and protocol funds become permanently locked because the math no longer balances.
Mitigation
Code defensively. Use balance-delta accounting (Edge Case #1) even if the token currently doesn't require it. Build pause functionality into your own protocol so you can halt operations if an upgrade breaks your integration.
Takeaway: You can't control token upgrades, but you can control how you calculate value. Which brings us to spot balances.
Edge Case #10: Flash-Mintable Tokens
The assumption
Massive token balances represent real, scarce capital.
What actually happens
Some tokens, like DAI, natively support flash-minting. A user can instantly mint millions of tokens in a single transaction, provided they are burned (with a fee) by the end of execution.
Example failure
Your protocol calculates governance voting power based on spot balances within a liquidity pool. An attacker flash-mints 100 million DAI, executes a massive governance manipulation, and repays the DAI in the same block.
Mitigation
Never rely on spot balances for price discovery or voting power. Use Time-Weighted Average Price (TWAP) oracles and historical checkpoints.
Takeaway: Spot balances lie. And sometimes, tokens lie about how much they transferred, too.
Edge Case #11: Transferring Less Than Requested
The assumption
If I request to transfer type(uint256).max, the token will either transfer that exact enormous amount or revert.
What actually happens
Some obscure tokens treat an amount parameter of type(uint256).max as a custom flag meaning "transfer all of the user's available balance."
Example failure
A protocol requests a uint256.max sweep. The token successfully transfers the user's actual balance of 50 tokens. The protocol incorrectly records that type(uint256).max tokens were received, creating massive artificial inflation.
Mitigation
Once again, balance-delta accounting saves the day. Never assume the requested amount is the executed amount.
Edge Case #12: High-Decimal Tokens
The assumption
Tokens either have 18 decimals (like ETH) or 6 decimals (like USDC).
What actually happens
Tokens like YAMv2 use 24 decimals.
Example failure
Your protocol multiplies a token balance by a high-precision constant before dividing it. Because the token already has 24 decimals, the multiplication exceeds type(uint256).max and triggers an unexpected math overflow, bricking the transaction.
Mitigation
Always dynamically read the decimals() function and normalize balances to a standard precision internally before performing complex math.
Bonus Edge Cases
Edge Case #13. Pausable Tokens:
Tokens can be globally paused by their admins. Ensure your system degrades gracefully and uses Pull-over-Push accounting so a globally paused token doesn't brick your entire transaction loop.
Edge Case #14. Large Approval/Transfer Reverts:
Tokens like UNI and COMP use uint96 for their internal accounting limits. Attempting to approve or transfer uint256.max will unexpectedly revert. Always approve exact required amounts.
Defensive ERC20 Integration Checklist
Before deploying any contract that touches external ERC20 tokens, verify your architecture against these rules:
-
Are you using SafeERC20? Never use bare
.transfer()or.transferFrom(). -
Are you measuring balance deltas? Never assume
amount sent == amount received. - Are you safe from reentrancy? Assume every token transfer is an external callback.
- Are you using Pull-over-Push? Ensure a failing transfer only affects the specific user, not the broader system loop.
- Have you normalized decimals? Do not assume 6 or 18 decimals.
- Do you rely on spot balances? Ensure oracles and voting mechanisms cannot be manipulated via flash-mints.
Closing Thoughts
Smart contract engineering is deeply unforgiving because you are not just building software; you are building immutable financial infrastructure.
When you integrate an external token, you do not just integrate an asset. You inherit its execution models, its upgrade paths, its governance assumptions, and its operational constraints. If the token's logic changes, or if it behaves in a way you didn't model for, your protocol pays the price.
Treat every external token as fundamentally hostile. Rely on pure math, stateful invariants, and defensive accounting.
Reliable systems emerge from reducing assumptions. Let's build something we can trust.
What edge cases have caused problems in your own deployments? Let's chat about it in the comments below. Follow for more deep dives into smart contract architecture and onchain security.
Top comments (0)