Resolving the token loss vulnerability in the Ethereum ERC-20 standard

Abstract

Custom tokens are fundamental in decentralized applications (dApps) operating on Ethereum and other Blockchain platforms. Ethereum, in particular, relies on the ERC-20 standard as a widely accepted token interface, facilitating seamless integration with numerous pre-existing dApps, user interface platforms, and popular web applications like exchange services. A notable security challenge within the ERC-20 framework is the “lost token problem”. This problem arises because users occasionally send tokens to the wrong addresses, and it has caused more than $27 million in damage. In this paper, we evaluate three existing solutions to this issue. Through the utilization of formal modeling, property specification, and the TLC model checker. Most importantly, we propose a novel double-layer solution to remedy the ERC-20 vulnerability. Our formal verification and experimental results indicate our approach encompasses the protection of the already deployed smart contracts, which is a critical aspect that has never been addressed in the existing mitigation techniques.