ERC-20 is insecure by design. It violates two of the most basic security principles: - Error handling is a must (there is no transaction handling which makes error handling impossible) - Secure defaults > In ERC-20 the `transfer(..)` function is unhandleable >> devs need a way to deposit tokens to contracts >>> they implement another `approve(..) transferFrom(..)` pattern to do so >>>>t hey leave `transfer(..)` unhandleable which makes the defaults of ERC-20 unsafe >>>>> approve transferFrom incentivizes DAPP devs to ask for an unlimited approval since it makes UX and gas fees for their users better >>>>>> users lose money but everyone blames them for making mistakes.... completely ignoring the fact that the root of the problem is the design of the standard and there are dozens of security researchers who are supposed to be competent enough to identify this Whom to blame? - Every security researcher/auditor who didn't write that ERC-20 is an insecure standard. What are they even doing if they don't expose violations of the most basic security principles while pretending to be security experts? Hey @SEAL_911 how many articles have you written about the fact that ERC-20 violates well-known software security principles? What have you done in 8 years to PREVENT it? If you design a piece of software and it violates 2 out of 8 most basic security principles guess what? - People lose money. I've outlined it many times and even designed an alternative ERC-223 standard in 2017 to solve these problems and eliminate the need for approvals completely: medium.com/dex223/erc-20-app… dexaran820.medium.com/securi… I've highlighted that ERC-20 design will inevitebly result in a loss of funds back during its finalization process github.com/ethereum/EIPs/pul… There were less than $20K at that momen. This problem report was ignored for 8 years and now there are more than $100,000,000 lost because of the lack of error handling and billions lost because of approval-related problems: dexaran.github.io/erc20-loss… Regarding approvals in ERC-20 standard (explanation: github.com/ethereum/ethereum…): - The standard was proposed in 2015, there was 1024-call-stack-depth bug in EVM. - Approve & transferFrom pattern was introduced to make tokens unaffected by this bug. It was not a smart design, it was a weird quirk to bypass bugs of EVM. - 1024-call-stack depth bug was fixed in 2016 and rendered approvals unnecessary. - In 2017 I proposed ERC-223 token standard which eliminates approvals completely.