A Novel Method to Prevent Multiple Withdraw Attack on ERC20 Tokens

Abstract

ERC20 is the first token standard on Ethereum and is widely used in ICOs, voting, and various asset representations. However, some methods defined in ERC20 imply potential vulnerabilities and Multiple Withdrawal Attack is one of them. Attackers can transfer more tokens than the actual allowance through this vulnerability. The current prevention methods for Multiple Withdrawal Attack include changing the transaction process, modifying the API of ERC20, and modifying the implementation of functions, etc. However, these methods have disadvantages such as poor compatibility, incomplete resolution, and high gas consumption. In this paper, we describe the process of Multiple Withdrawal Attack and analyze the shortcomings of the existing methods, and then propose a solution with lower gas consumption. In our method, a variable is added to record the allowance in the approval function to prevent tokens from being transferred repeatedly. Finally, the effectiveness and the performance of the proposed method is analyzed. The result shows that the method proposed in this paper is safe and has lower gas consumption than the existing methods.