Abstract:The prosperity of decentralized finance motivates many investors to profit via trading their crypto assets on decentralized applications (DApps for short) of the Ethereum ecosystem. Apart from Ether (the native cryptocurrency of Ethereum), many ERC20 (a widely used token standard on Ethereum) tokens obtain vast market value in the ecosystem. Specifically, the approval mechanism is used to delegate the privilege of spending users’ tokens to DApps. By doing so, the DApps can transfer these tokens to arbitrary receivers on behalf of the users. To increase the usability, unlimited approval is commonly adopted by DApps to reduce the required interaction between them and their users. However, as shown in existing security incidents, this mechanism can be abused to steal users’ tokens. In this paper, we present the first systematic study to quantify the risk of unlimited approval of ERC20 tokens on Ethereum. Specifically, by evaluating existing transactions up to 31st July 2021, we find that unlimited approval is prevalent (60%, 15.2M/25.4M) in the ecosystem, and 22% of users have a high risk of their approved tokens for stealing. After that, we investigate the security issues that are involved in interacting with the UIs of 22 representative DApps and 9 famous wallets to prepare the approval transactions. The result reveals the worrisome fact that all DApps request unlimited approval from the front-end users and only 10% (3/31) of UIs provide explanatory information for the approval mechanism. Meanwhile, only 16% (5/31) of UIs allow users to modify their approval amounts. Finally, we take a further step to characterize the user behavior into five modes and formalize the good practice, i.e., on-demand approval and timely spending, towards securely spending approved tokens. However, the evaluation result suggests that only 0.2% of users follow the good practice to mitigate the risk. Our study sheds light on the risk of unlimited approval and provides suggestions to secure the approval mechanism of the ERC20 tokens on Ethereum.

Interface Illusions: Uncovering the Rise of Visual Scams in Cryptocurrency Wallets

TxPhishScope: Towards Detecting and Understanding Transaction-based Phishing on Ethereum

Penny Wise and Pound Foolish: Quantifying the Risk of Unlimited Approval of ERC20 Tokens on Ethereum.

Characterizing cryptocurrency exchange scams

Trade or Trick? Detecting and Characterizing Scam Tokens on Uniswap Decentralized Exchange

Smart Contract Vulnerability Detection Technique: A Survey

Conning the Crypto Conman: End-to-End Analysis of Cryptocurrency-based Technical Support Scams

SoK: Design, Vulnerabilities, and Security Measures of Cryptocurrency Wallets

Tracking Counterfeit Cryptocurrency End-to-end

Give and Take: An End-To-End Investigation of Giveaway Scam Conversion Rates

From Tweet to Theft: Tracing the Flow of Stolen Cryptocurrency

All Your Tokens are Belong to Us: Demystifying Address Verification Vulnerabilities in Solidity Smart Contracts

WalletRadar: towards automating the detection of vulnerabilities in browser-based cryptocurrency wallets

Don't Fish in Troubled Waters! Characterizing Coronavirus-themed Cryptocurrency Scams

Targeting the Weakest Link: Social Engineering Attacks in Ethereum Smart Contracts

Navigating the digital currency landscape: A comprehensive examination from blockchain foundations to website security

Tracing Cryptocurrency Scams: Clustering Replicated Advance-Fee and Phishing Websites

The Eye of Horus: Spotting and Analyzing Attacks on Ethereum Smart Contracts

Towards Understanding Crypto Money Laundering in Web3 Through the Lenses of Ethereum Heists

Who Stole My NFT? Investigating Web3 NFT Phishing Scams on Ethereum

An Empirical Analysis of Scam Tokens on Ethereum Blockchain