Token

Token Vulnerability Patterns

This skill provides comprehensive knowledge for identifying token-related vulnerabilities in smart contracts.

Overview

Not all tokens follow the "happy path" of standard implementations. Protocols must handle edge cases from fee tokens, rebasing tokens, callback tokens, and malicious tokens.

Token Weirdness Categories

1. Fee-On-Transfer Tokens

Vulnerable Pattern:

// DANGEROUS: Assumes transfer amount equals received amount
function deposit(uint256 amount) external {
    token.transferFrom(msg.sender, address(this), amount);
    balances[msg.sender] += amount; // May be more than received!
}

Secure Pattern:

function deposit(uint256 amount) external {
    uint256 balanceBefore = token.balanceOf(address(this));
    token.transferFrom(msg.sender, address(this), amount);
    uint256 received = token.balanceOf(address(this)) - balanceBefore;
    balances[msg.sender] += received;
}

Common Fee Tokens:

• PAXG (0.02% fee)
• STA (1% fee)
• USDT (potential fee, currently 0)

Detection:

Grep("transferFrom.*\\+=|transfer.*\\+=", glob="**/*.sol")

2. Rebasing Tokens

Vulnerable Pattern:

// DANGEROUS: Caches balance that will change
function stake(uint256 amount) external {
    token.transferFrom(msg.sender, address(this), amount);
    stakedAmount[msg.sender] = amount; // Becomes stale!
}

Secure Pattern:

// Use shares instead of amounts
function stake(uint256 amount) external {
    uint256 totalBefore = token.balanceOf(address(this));
    token.transferFrom(msg.sender, address(this), amount);
    uint256 received = token.balanceOf(address(this)) - totalBefore;

    uint256 shares = totalShares == 0
        ? received
        : received * totalShares / totalBefore;
    userShares[msg.sender] += shares;
    totalShares += shares;
}

Common Rebasing Tokens:

• stETH (positive rebase daily)
• AMPL (elastic supply)
• OHM (rebasing)
• aTokens (AAVE interest)

Detection:

• Look for balance caching
• Check if protocol claims to support stETH, AMPL

3. ERC777 Callback Reentrancy

Vulnerable Pattern:

// DANGEROUS: State updated after transfer
function withdraw(uint256 amount) external {
    require(balances[msg.sender] >= amount);
    token.transfer(msg.sender, amount); // Triggers tokensReceived!
    balances[msg.sender] -= amount; // Too late!
}

ERC777 Hooks:

• tokensToSend() - Called BEFORE transfer on sender
• tokensReceived() - Called AFTER transfer on recipient

Detection:

Grep("IERC777|tokensReceived|tokensToSend", glob="**/*.sol")

4. ERC721/1155 Callback Reentrancy

Vulnerable Pattern:

// DANGEROUS: safeTransfer triggers callback
function claimNFT(uint256 tokenId) external {
    nft.safeTransferFrom(address(this), msg.sender, tokenId);
    // onERC721Received callback runs HERE
    claimed[tokenId] = true; // State update after callback!
}

Callback Functions:

• onERC721Received() - ERC721 safeTransfer
• onERC1155Received() - ERC1155 safeTransfer
• onERC1155BatchReceived() - ERC1155 safeBatchTransfer

Detection:

Grep("safeTransferFrom|safeMint|safeTransfer", glob="**/*.sol")

5. Missing Return Value (USDT)

Vulnerable Pattern:

// DANGEROUS: USDT doesn't return bool
function deposit(uint256 amount) external {
    bool success = token.transfer(address(this), amount);
    require(success, "Transfer failed"); // USDT reverts here!
}

Secure Pattern:

import "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";

function deposit(uint256 amount) external {
    token.safeTransferFrom(msg.sender, address(this), amount);
}

Tokens Without Return:

• USDT
• BNB
• Some older tokens

Detection:

Grep("transfer\\(|transferFrom\\(", glob="**/*.sol")

Check if using SafeERC20 wrapper.

6. Blacklist/Pausable Tokens

Risk: Transfers can be blocked, causing DoS.

Affected Tokens:

• USDC (blacklist)
• USDT (blacklist + pausable)
• DAI (pausable)

Vulnerable Pattern:

// DANGEROUS: Can be blocked if recipient blacklisted
function withdraw() external {
    token.transfer(msg.sender, balances[msg.sender]); // May revert!
}

Mitigation:

• Use pull-over-push pattern
• Allow alternate withdrawal addresses
• Handle transfer failures gracefully

7. Low Decimal Tokens

Vulnerable Pattern:

// DANGEROUS: Precision loss with low decimals
// WBTC has 8 decimals, not 18
uint256 priceInWei = wbtcAmount * ethPrice / 1e18; // Wrong scale!

Common Low Decimal Tokens:

• WBTC (8 decimals)
• USDC (6 decimals)
• USDT (6 decimals)

Detection:

Grep("decimals|1e18|1e6|1e8", glob="**/*.sol")

8. Approval Race Condition

Vulnerable Pattern:

// DANGEROUS: Front-runnable approve
token.approve(spender, newAmount);

Attack:

1. User has 100 approved
2. User calls approve(50) to reduce
3. Attacker front-runs: transferFrom(100)
4. Approve(50) executes
5. Attacker calls: transferFrom(50)
6. Total stolen: 150

Secure Pattern:

// Reset to 0 first, or use increaseAllowance
token.approve(spender, 0);
token.approve(spender, newAmount);

// Or use OZ increaseAllowance/decreaseAllowance
token.increaseAllowance(spender, amount);

Token Compatibility Matrix

*USDT has fee mechanism but set to 0

Token Audit Checklist

• Balance changes measured, not assumed (fee tokens)
• Shares used instead of amounts (rebasing tokens)
• CEI pattern followed for callbacks (ERC721/777/1155)
• SafeERC20 used for transfers
• Blacklist handling considered
• Decimal precision handled correctly
• Approval race condition mitigated
• Zero-amount transfers handled

Severity Classification

Critical

• ERC777 reentrancy
• ERC721/1155 callback reentrancy
• Fee token accounting mismatch

High

• Rebasing token balance caching
• Missing return value handling
• Decimal precision errors

Medium

• Blacklist DoS potential
• Approval race condition
• No zero-amount validation

Additional Token Patterns (2025-2026)

9. ERC-2612 Permit Vulnerabilities

Vulnerable Pattern:

// DANGEROUS: No deadline validation
function depositWithPermit(
    uint256 amount,
    uint8 v, bytes32 r, bytes32 s
) external {
    token.permit(msg.sender, address(this), amount, type(uint256).max, v, r, s);
    // @audit deadline = max allows signature to be used forever
    token.transferFrom(msg.sender, address(this), amount);
}

Secure Pattern:

function depositWithPermit(
    uint256 amount,
    uint256 deadline,
    uint8 v, bytes32 r, bytes32 s
) external {
    require(deadline >= block.timestamp, "Expired");
    token.permit(msg.sender, address(this), amount, deadline, v, r, s);
    token.transferFrom(msg.sender, address(this), amount);
}

Signature Replay Risks:

• Same signature valid on multiple chains (missing chainId)
• Permit can be front-run if deadline is far future
• DoS by calling permit with invalid signature (some implementations)

Search Queries:

Grep("permit|Permit|PERMIT_TYPEHASH|nonces", glob="**/*.sol")
Grep("ecrecover|ECDSA|v.*r.*s", glob="**/*.sol")

10. Permit2 Vulnerabilities (Uniswap)

Overview: Permit2 is a universal approval system that introduces new attack vectors.

Vulnerable Pattern:

// DANGEROUS: No expiration check on permit2
function swapWithPermit2(
    ISignatureTransfer.PermitTransferFrom calldata permit,
    ISignatureTransfer.SignatureTransferDetails calldata transferDetails,
    bytes calldata signature
) external {
    permit2.permitTransferFrom(permit, transferDetails, msg.sender, signature);
    // @audit What if permit.deadline is far in future?
}

Permit2 Specific Risks:

1. Batch Permits: Single signature approves multiple tokens
2. Witness Data: Additional data can be signed but misinterpreted
3. Signature Malleability: Different signatures for same approval
4. Nonce Invalidation: Can invalidate others' permits

Search Queries:

Grep("Permit2|permit2|ISignatureTransfer|IAllowanceTransfer", glob="**/*.sol")
Grep("permitTransferFrom|permitWitnessTransferFrom", glob="**/*.sol")

Security Checklist:

• Deadline always validated
• Nonce management understood
• Witness data properly validated
• Signature cannot be reused maliciously

11. ERC-4626 Token Integration Risks

When integrating ERC-4626 vaults as collateral or tokens:

Vulnerable Pattern:

// DANGEROUS: Trusting vault's reported value
function getCollateralValue(address user) external view returns (uint256) {
    uint256 shares = vault.balanceOf(user);
    return vault.convertToAssets(shares);  // @audit Can be manipulated via donation!
}

Attack Vector:

1. Attacker donates to vault, inflating totalAssets
2. convertToAssets() returns inflated value
3. Protocol accepts as collateral at wrong price
4. Attacker borrows against inflated collateral

Secure Pattern:

// Use time-weighted or oracle-based pricing for ERC-4626 tokens
function getCollateralValue(address user) external view returns (uint256) {
    uint256 shares = vault.balanceOf(user);
    // Use external oracle for share price, NOT vault.convertToAssets()
    uint256 sharePrice = oracle.getPrice(address(vault));
    return shares * sharePrice / 1e18;
}

Search Queries:

Grep("ERC4626|convertToAssets|convertToShares|previewDeposit", glob="**/*.sol")
Grep("vault.*balanceOf|collateral.*vault", glob="**/*.sol")

12. ERC-1363 (transferAndCall) Reentrancy

Vulnerable Pattern:

// DANGEROUS: ERC-1363 triggers callback on receive
function receiveApproval(
    address from,
    uint256 amount,
    address token,
    bytes calldata data
) external {
    // @audit This is called during transferAndCall/approveAndCall
    // State may not be updated yet!
}

Search Queries:

Grep("ERC1363|transferAndCall|approveAndCall|onApprovalReceived", glob="**/*.sol")

13. ERC-6909 Minimal Multi-Token

Streamlined ERC-1155 alternative: no callbacks, no batching, per-token granular approvals.

Vulnerable Pattern:

// DANGEROUS: Missing per-token allowance check
require(isApprovedForAll[from][msg.sender], "Not approved");
balanceOf[from][id] -= amount; // @audit allowance[from][msg.sender][id]?

Search: Grep("ERC6909|isApprovedForAll|allowance.*id", glob="**/*.sol")

Updated Token Compatibility Matrix (2025-2026)

*USDT has fee mechanism but set to 0

Search Query Reference

# Find permit patterns
Grep("permit|Permit|DOMAIN_SEPARATOR|PERMIT_TYPEHASH", glob="**/*.sol")
Grep("permit2|Permit2|ISignatureTransfer", glob="**/*.sol")

# Find callback tokens
Grep("ERC777|ERC1363|tokensReceived|onTransferReceived", glob="**/*.sol")
Grep("safeTransfer|safeMint|onERC721Received", glob="**/*.sol")

# Find vault integrations
Grep("ERC4626|convertToAssets|convertToShares", glob="**/*.sol")

# Find decimal handling
Grep("decimals\\(\\)|10\\*\\*.*decimals", glob="**/*.sol")